{"id":179,"date":"2025-08-26T16:48:26","date_gmt":"2025-08-26T16:48:26","guid":{"rendered":"https:\/\/blog.hostek.com\/?p=179"},"modified":"2025-08-26T16:48:26","modified_gmt":"2025-08-26T16:48:26","slug":"how-we-solved-a-major-sql-tls-1-0-problem","status":"publish","type":"post","link":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/how-we-solved-a-major-sql-tls-1-0-problem\/","title":{"rendered":"How We Solved A Major SQL TLS 1.0 Problem"},"content":{"rendered":"\n

We had a customer who was working on PCI compliance \u2013 and failing scans due to weak ciphers and TLS 1.0 being enabled. We have some information about PCI Compliance<\/a> in our support wiki describing what is disabled on our shared servers and why.<\/p>\n\n\n\n

Since we help customers obtain PCI compliance by providing guidance and a secure infrastructure<\/a> we thought this would be a simple task that we are familiar doing.<\/p>\n\n\n\n

We have a PowerShell script for disabling weak ciphers and outdated protocols on Windows Servers (Windows VPS Hosting<\/a> in this case). We ran the script and completed the process by rebooting the server.<\/p>\n\n\n\n

BIG PROBLEM \u2013 The MSSQL Server Service failed to start.<\/h2>\n\n\n\n

MSSQL and their app were hosted on the same machine. We advised them to isolate app and sql on different servers for best security practices. They hadn\u2019t made this change yet but had plans to do so.<\/p>\n\n\n\n

Trial And Error \u2013 Solving The Problem with SQL TLS Protocols<\/h3>\n\n\n\n
    \n
  1. (FAIL) We tried the Local Security Policy, enabling \u201cSystem Cryptography: Use FIPS compliant\u201d see image below. We quickly learned after a reboot that our original changes to the cipher suite and weak protocols were undone and TLS 1.0 was enabled. Microsoft actually has a great post on why they don\u2019t recommend FIPS anymore. And SQL would not start.SQL TLS Fips Compliance – PCI Compliance Troubleshooting<\/li>\n\n\n\n
  2. (FAIL) We thought to had missed something. We reset the settings back to what we had before. As I mentioned before we use a PowerShell script to automate these changes but the manual methods are described in KB245030<\/a>. We rebooted and, SQL Failed to start<\/strong>.<\/li>\n\n\n\n
  3. (WIN) We did more thorough search on SQL SSL<\/a> protocols and discovered that TLS 1.1 and 1.2 were not supported at the time. Although a patch would be released soon.<\/li>\n\n\n\n
  4. (SOLUTION) A patch for SQL (2012 in this case) was released. We updated the server to the latest patch version and restarted SQL. SQL was able to start without problem. This particular patch was SQL 2012 SP2 CU6<\/a>.<\/li>\n<\/ol>\n\n\n\n

    Check Your Version<\/h3>\n\n\n\n

    Check your version of SQL by running SQL Server Management Studio and right clicking on the instance name, select properties.<\/p>\n\n\n\n

    Then check this handy chart<\/a> for more specific detail related to SQL versions, builds and download links. For SQL 2012 you\u2019ll need at least SP2 CU6.<\/p>\n\n\n\n

    In Summary<\/h2>\n\n\n\n

    To pass PCI compliance your server needs to have only the most secure protocols and ciphers. You should also have your database on a dedicated server \u2013 especially if it contains credit card data of any kind.<\/p>\n\n\n\n

    For the highest SQL encryption you should patch to the latest release of 2008, 2012 and 2014<\/strong>. Then disable weak ciphers.<\/p>\n\n\n\n

    If you want help achieving PCI Compliance on Virtual Servers we can help<\/a>. Get one on one advice from a server expert by scheduling a free consultation<\/a> appointment.<\/p>\n","protected":false},"excerpt":{"rendered":"

    We had a customer who was working on PCI compliance \u2013 and failing scans due to weak ciphers and TLS 1.0 being enabled. We have some…<\/p>\n","protected":false},"author":2,"featured_media":180,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-179","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-developers"],"_links":{"self":[{"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/posts\/179","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=179"}],"version-history":[{"count":0,"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/posts\/179\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/media\/180"}],"wp:attachment":[{"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=179"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=179"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hassantest-com.server-hassanzahoor-com.vps.ezhostingserver.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=179"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}