How to determine that our SQL Build number 11.0.6540.0 Supports TLS 1.2 and does not require any SQL patch update

Question

How to determine that our SQL Build number 11.0.6540.0 Supports TLS 1.2 and does not require any SQL patch update

Answer 1

Your SQL Server 2012 is on patch level SP3 + CU4
https://sqlserverbuilds.blogspot.com/2012/01/sql-server-2012-versions.html

so you don't need an further update for TLS 1.2
https://support.microsoft.com/en-us/topic/kb3135244-tls-1-2-support-for-microsoft-sql-server-e4472ef8-90a9-13c1-e4d8-44aad198cdbe

But I would install latest SP4 + latest CU for more security.

Answer 2

See this on the same subject:

https://learn.microsoft.com/en-us/answers/questions/682065/sql-server-2016-o365-smtp-34failure-sending-mail34.html

TLS 1.2 may not be enabled as a default.

Answer 3

Thank you for all your help on this subject.

We updated Registry keys as per documentation, but still we were unable to send email from SQL DBmail. Below is the message recorded.

"The mail could not be sent to the recipients because of the mail server failure. (Sending Mail using Account 3 (2022-01-13T00:23:22). Exception Message: Cannot send mails to mail server. (Failure sending mail.)."

For verification we used the same email details to send test email from PowerShell Script (on same SQL DBmail server) and we were able to send emails from it.

Not sure why we are not able to send it via SQL DBmail.

Answer 4

We do have all the below registry keys and we have rebooted the server still no sucess.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001 ==> Yes

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001 ==>Yes

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001 ==>yes

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft.NETFramework\v4.0.30319]
"SchUseStrongCrypto"=dword:00000001 ==> as as above Yes

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"DisabledByDefault"=dword:00000000 ==> Yes
"Enabled"=dword:00000001 ==>Yes

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"DisabledByDefault"=dword:00000000 ==> yes
"Enabled"=dword:00000001 ==> yes

Answer 5

We are unable to fix TLS 1.2 issue on our servers. We applied all the above steps notified.

Just for our information we are on Windows Server 2012 R2 with .Net Framework 3.5 and SQL Build number 11.0.6540.0 (SQL 2012 R2).

We get below error in Databasemail log

"The mail could not be sent to the recipients because of the mail server failure. (Sending Mail using Account 3 (2022-01-13T00:23:22). Exception Message: Cannot send mails to mail server. (Failure sending mail.)."