How to fix Microsoft ODBC Driver 17 for SQL Server : SSL Provider ssl_choose_client_version:unsupported protocol

Question

I have installed Sql Server 2019 Developer Edition and mssql-tools on my Ubuntu 20.04 minimal. I can connect to my localhost with no issue, but when I want to remote to another sql server:

sqlcmd -S <server> -U <username> -P <password>

I face this error:

Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : SSL Provider: [error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol].
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Client unable to establish connection.

I has this issue once in Debian 10, and also search the net for solution, so after that I change my openssl.conf manually (su permission needed):

nano /etc/ssl/openssl.cnf

and add these to my file:

• ess_cert_id_alg = sha1 under the [tsa_config1] heading

• openssl_conf = default_conf near the top

• the following at the end:

  [default_conf]

  ssl_conf = ssl_sect

  [ssl_sect]

  system_default = system_default_sect

  [system_default_sect]

  MinProtocol = TLSv1.0

  CipherString = DEFAULT@SECLEVEL=1

I know that MinProtocol and CipherString are normally set to TLSv1.2 and DEFAULT@SECLEVEL=2, but as I mentioned once in my Debian 10, I edited my openssl.conf and change TLSv1.2 to TLSv1.0 and DEFAULT@SECLEVEL=2 to DEFAULT@SECLEVEL=1 and my connection fixed, but in Ubuntu 20.04 minimal not only there wasn't these lines, but also when I insert these manually again I face the same error:

Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : SSL Provider: [error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol].
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Client unable to establish connection.

my opnessl version is:

OpenSSL 1.1.1f  31 Mar 2020

I also downgrade my openssl once to 1.0 but it didn't work either!

I couldn't find anything else so I came here to ask for help, appreciate your help.

Answer 1

1.1.1m save my life. Install it manually.

The manual installation looks like:

wget https://www.openssl.org/source/latest.tar.gz -O openssl-1.1.1h.tar.gz

tar -zxvf openssl-1.1.1m.tar.gz

cd openssl-1.1.1m

./config

make

sudo make install

openssl version

sudo ldconfig

Answer 2

Try to add -C option to trust the server certificate:

sqlcmd -S <server> -U <username> -P <password> -C

For more details, please check my answer here: https://stackoverflow.com/a/73443215/970830