msphpsql: SSL routines:ssl_choose_client_version:unsupported protocol]
.+Please check the FAQ (frequently-asked questions) first. If you have other questions or something to report, please address the following:
+## PHP Driver version or file name
- Driver 17 +## SQL Server version
- Microsoft SQL Server 2008 (SP4) - 10.0.6241.0 (X64) Apr 17 2015 10:56:08 Copyright © 1988-2008 Microsoft Corporation Enterprise Edition (64-bit) on Windows NT 6.3 <X64> (Build 9600: ) +## Client operating system
- Debian +## PHP version
- PHP:FPM +## Microsoft ODBC Driver version
+## Table schema
- dbo +## Problem description
I am getting this error below. Not sure what’s exactly causing it, but seems that the the SQL Server doesn’t support ssl version the driver requires. SQLSTATE[08001]: [Microsoft][ODBC Driver 17 for SQL Server]SSL Provider: [error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol] (SQL: select top 1 * from [users] where [email] = example@example.com) +## Expected behavior and actual behavior + +## Repro code or steps to reproduce Dockerfile
FROM php:fpm
# composer.lock and composer.json
COPY composer.lock composer.json /var/www/
# Set working directory
WORKDIR /var/www
# Install dependencies
RUN apt-get update && apt-get install -y \
build-essential \
libpng-dev \
libzip-dev \
libjpeg62-turbo-dev \
libfreetype6-dev \
locales \
zip \
jpegoptim optipng pngquant gifsicle \
vim \
unzip \
git \
curl\
gnupg2\
curl apt-transport-https debconf-utils
# Clear cache
RUN apt-get clean && rm -rf /var/lib/apt/lists/*
# Install extensions
RUN docker-php-ext-install pdo_mysql mbstring zip exif pcntl
RUN docker-php-ext-configure gd --with-gd --with-freetype-dir=/usr/include/ --with-jpeg-dir=/usr/include/ --with-png-dir=/usr/include/
RUN docker-php-ext-install gd
# Install composer
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
# Add user for laravel application
RUN groupadd -g 1000 www
RUN useradd -u 1000 -ms /bin/bash -g www www
Add . /var/www
RUN chown -R www:www /var/www
# Copy existing application directory contents
COPY . /var/www
# Copy existing application directory permissions
COPY --chown=www:www . /var/www
# Microsft SQL driver install
RUN curl https://packages.microsoft.com/keys/microsoft.asc | apt-key add -
#RUN curl https://packages.microsoft.com/config/ubuntu/18.04/prod.list > /etc/apt/sources.list.d/mssql-tools.list
RUN curl https://packages.microsoft.com/config/debian/8/prod.list > /etc/apt/sources.list.d/mssql-release.list
RUN apt-get update
RUN echo 'y' | ACCEPT_EULA=Y apt-get install msodbcsql17 mssql-tools
RUN echo 'export PATH="$PATH:/opt/mssql-tools/bin"' >> ~/.bash_profile
RUN echo 'export PATH="$PATH:/opt/mssql-tools/bin"' >> ~/.bashrc
RUN apt-get install -y unixodbc-dev
RUN pecl install sqlsrv \
&& pecl install pdo_sqlsrv \
&& docker-php-ext-enable sqlsrv pdo_sqlsrv
# Change current user to www
USER www
# Expose port 9000 and start php-fpm server
EXPOSE 9000
CMD ["php-fpm"]
docker-compose.yml
version: '3'
services:
#PHP Service
app:
build:
context: .
dockerfile: Dockerfile
image: phpimage
container_name: app
restart: unless-stopped
tty: true
environment:
SERVICE_NAME: app
SERVICE_TAGS: dev
working_dir: /var/www
volumes:
- ./:/var/www
- ./php/local.ini:/usr/local/etc/php/conf.d/local.ini
networks:
- app-network
#Nginx Service
webserver:
image: nginx:alpine
container_name: webserver
restart: unless-stopped
tty: true
ports:
- "80:80"
- "443:443"
volumes:
- ./:/var/www
- ./nginx/conf.d/:/etc/nginx/conf.d/
networks:
- app-network
#Docker Networks
networks:
app-network:
driver: bridge
#Volumes
volumes:
dbdata:
driver: local
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Reactions: 3
- Comments: 23 (5 by maintainers)
@lmtam Yes. You could upgrade you SQL Server as @david-puglielli mentioned, or you could downgrade openssl minprotocol and CipherString.
if you are using debian. You can add this to your dockerfile which should fix the file. Understand, however, that there is a security risk with this.
Downgrading the minimum to TLSv1.0 actually worked, but it is not a permanent solution. I changed /etc/ssl/openssl.cnf section [system_default_sect] to
[system_default_sect] MinProtocol = TLSv1.0 CipherString = DEFAULT@SECLEVEL=1
this configuration worked for me
I’m getting the same issue after upgrading to Ubuntu 20.04 Beta…first, it worked on 19.10…but after upgrade ubuntu distro, it prompt me the error.By the way, I’m not using docker
For those who are in the same situation (cannot update SQLServer) and are on Oracle Linux 8.2 (probably CentOS 8 too), just change
MinProtocoltoTLSv1.0in the file:/etc/crypto-policies/back-ends/opensslcnf.configBe careful and use TLSv1 instead of TLSv1.0
Cheers
This is very useful to me.