TLS related with Windows 2019 & SQL Server 2019 ?

Question

Hello, sorry am confused.

My questions are how TLS corresponds within Windows Server 2019 on OS level & SQL Server 2019 installed on same VM.

Is TLS v1.0 & v1.1 disabled by default on both?

And TLS v1.2 is enabled by default on both?

What's the difference via the registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols and TLS listed in Web Browser settings?

Is it correct to say in example TLS v1.2 is enabled on Windows level but not on SQL Server level it would not allow SQL DB connection and vice versa?

Thanks in advance.

Answer 1

Hi @techresearch7777777 ,

> Windows Server 2019 currently TLS versions: 1.0 = Disabled, 1.1 = Disabled, 1.2 = Enabled Would a connection into SQL Server 2019 that's installed on same VM Windows Server 2019 mentioned above require only TLS v1.2 by default or would it allow all three (v1.0, v1.1, v1.2) from a remote client ?

According to your description, SQL server require only TLS 1.2 in this situation.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

Hi @techresearch7777777 ,

For the most part, protocol usage is controlled at three levels, the operating system level, the framework or platform level, and the application level. TLS 1.2 is enabled by default at the operating system level.

> Is TLS v1.0 & v1.1 disabled by default on both?

No, it is enabled by default. You need to disable it manually in registry.

> And TLS v1.2 is enabled by default on both?

Yes, you are right.

The following tasks are needed for enabling TLS 1.2 on the site servers and remote site systems:

•Ensure that TLS 1.2 is enabled as a protocol for SChannel at the operating system level
•Update and configure the .NET Framework to support TLS 1.2
•Update SQL Server and client components
•Update Windows Server Update Services (WSUS)

Suggest you reading below MS document to better understand TLS 1.2.

How to enable TLS 1.2 on the site servers and remote site systems

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 3

Thanks bunch Cathyji-msft for your reply.

Sorry still a bit foggy on this, guess to simplify my question situation as follows:

• Windows Server 2019 currently TLS versions: 1.0 = Disabled, 1.1 = Disabled, 1.2 = Enabled

Would a connection into SQL Server 2019 that's installed on same VM Windows Server 2019 mentioned above require only TLS v1.2 by default or would it allow all three (v1.0, v1.1, v1.2) from a remote client ?

Hope all is well.

Answer 4

See:

https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2#what-determines-which-encryption-protocol-is-used

And "Frequently asked questions":
https://support.microsoft.com/en-us/topic/kb3135244-tls-1-2-support-for-microsoft-sql-server-e4472ef8-90a9-13c1-e4d8-44aad198cdbe

Answer 5

Thanks much for all the replies and Cathyji-msft for helping me understand better in my current situation question.