Windows Server 2016 Cipher Suites not working

user_1842350 0
Viewed 706

I'm trying to connect to the Exasol database using Powershell with ADO.NET driver. I can successfully connect from my Windows 10 PC, but can't from Windows Server 2016. The error message is:

Error: SSL authentication failed. AuthenticationException: A call to SSPI failed, see inner exception.
Error: Inner exception: The client and server cannot communicate, because they do not possess a common algorithm
Debug: Exasol.EXADataProvider.EXAClientException (0x80004005): TLS connection to host (exadb1) failed: A call to SSPI failed, see inner exception.
   at Exasol.EXADataProvider.backend.BackendFactory.ConnectToServer(String hostIp, Int32 serverPort, String serverName, String userFingerprint)
   at Exasol.EXADataProvider.backend.BackendFactory.PerformLogin(EXAConnectionStringBuilder connectString)

I checked that TLS 1.2 is enabled on Windows Server. I thought, maybe Windows Server doesn't have proper Cipher Suites, which Exasol accepts.

Below is what Get-TlsCipherSuite command returns on my computer. Last column shows which Cipher Suites were mentioned in Wireshark log.

Name Certificate Cipher CipherLength Wireshark
TLS_AES_256_GCM_SHA384 AES 256
TLS_AES_128_GCM_SHA256 AES 128
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0 Client Hello
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ECDSA AES 128 Client Hello
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 RSA AES 256 Client & Server Hello
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 RSA AES 128 Client Hello
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 RSA AES 256 Client Hello
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 RSA AES 128 Client Hello
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0 Client Hello
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ECDSA AES 128 Client Hello
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 RSA AES 256 Client Hello
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 RSA AES 128 Client Hello
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ECDSA AES 256 Client Hello
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA ECDSA AES 128 Client Hello
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA RSA AES 256 Client Hello
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA RSA AES 128 Client Hello
TLS_RSA_WITH_AES_256_GCM_SHA384 RSA AES 256 Client Hello
TLS_RSA_WITH_AES_128_GCM_SHA256 RSA AES 128 Client Hello
TLS_RSA_WITH_AES_256_CBC_SHA256 RSA AES 256 Client Hello
TLS_RSA_WITH_AES_128_CBC_SHA256 RSA AES 128 Client Hello
TLS_RSA_WITH_AES_256_CBC_SHA RSA AES 256 Client Hello
TLS_RSA_WITH_AES_128_CBC_SHA RSA AES 128 Client Hello
TLS_RSA_WITH_3DES_EDE_CBC_SHA RSA 3DES 168 Client Hello
TLS_RSA_WITH_NULL_SHA256 RSA 0
TLS_RSA_WITH_NULL_SHA RSA 0
TLS_PSK_WITH_AES_256_GCM_SHA384 0
TLS_PSK_WITH_AES_128_GCM_SHA256 AES 128
TLS_PSK_WITH_AES_256_CBC_SHA384 AES 256
TLS_PSK_WITH_AES_128_CBC_SHA256 AES 128
TLS_PSK_WITH_NULL_SHA384 0
TLS_PSK_WITH_NULL_SHA256 0

Here is result of Get-TlsCipherSuite command on Windows Server 2016. Last column shows which Cipher Suites were mentioned in Wireshark log.

Name Certificate Cipher CipherLength Wireshark
TLS_AES_256_GCM_SHA384 0
TLS_AES_128_GCM_SHA256 0
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ECDSA AES 256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ECDSA AES 128
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 RSA AES 256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 RSA AES 128
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 RSA AES 256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 RSA AES 128
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ECDSA AES 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 RSA AES 256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 RSA AES 128
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ECDSA AES 256 Client Hello
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA ECDSA AES 128 Client Hello
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA RSA AES 256 Client & Server Hello
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA RSA AES 128 Client Hello
TLS_DHE_RSA_WITH_AES_256_CBC_SHA RSA AES 256 Client Hello
TLS_DHE_RSA_WITH_AES_128_CBC_SHA RSA AES 128 Client Hello
TLS_RSA_WITH_AES_256_GCM_SHA384 RSA AES 256
TLS_RSA_WITH_AES_128_GCM_SHA256 RSA AES 128
TLS_RSA_WITH_AES_256_CBC_SHA256 RSA AES 256
TLS_RSA_WITH_AES_128_CBC_SHA256 RSA AES 128
TLS_RSA_WITH_AES_256_CBC_SHA RSA AES 256 Client Hello
TLS_RSA_WITH_AES_128_CBC_SHA RSA AES 128 Client Hello
TLS_RSA_WITH_3DES_EDE_CBC_SHA RSA 3DES 168 Client Hello
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 0
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 DSA AES 128
TLS_DHE_DSS_WITH_AES_256_CBC_SHA DSA AES 256 Client Hello
TLS_DHE_DSS_WITH_AES_128_CBC_SHA DSA AES 128 Client Hello
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA DSA 3DES 168 Client Hello
TLS_RSA_WITH_RC4_128_SHA RSA RC4 128 Client Hello
TLS_RSA_WITH_RC4_128_MD5 RSA RC4 128 Client Hello
TLS_RSA_WITH_NULL_SHA256 RSA 0
TLS_RSA_WITH_NULL_SHA RSA 0
TLS_PSK_WITH_AES_256_GCM_SHA384 0
TLS_PSK_WITH_AES_128_GCM_SHA256 AES 128
TLS_PSK_WITH_AES_256_CBC_SHA384 AES 256
TLS_PSK_WITH_AES_128_CBC_SHA256 AES 128
TLS_PSK_WITH_NULL_SHA384 0
TLS_PSK_WITH_NULL_SHA256 0

For some reason lists of Cipher Suites in Powershell and Wireshark don't match.

Do you know how to "activate" Cipher Suites on Windows Server? Why some of them are not used? Looks like Exasol would like to use TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, but Windows Server for some reason can't use it.

tls1.2 wireshark ado.net encryption powershell
3 Answers

You can use Enable-TlsCipherSuite to add additional ciphers to your server.

Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"

The above in an elevated powershell instance should give you an idea of where to go next

user_84312380

Try enforcing the tls protocol at the start of your script:

[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -bor [System.Net.SecurityProtocolType]::Tls13
user_8900970

After all, setting SystemDefaultTlsVersions and SchUseStrongCrypto registry keys helped. https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls#systemdefaulttlsversions

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions"=dword:00000001
"SchUseStrongCrypto"=dword:00000001

Before this change, [System.Net.ServicePointManager]::SecurityProtocol was returning Ssl3, Tls. After the change it started to return SystemDefault. And no more errors occur.

Also, I checked, now TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 cipher suite is used now.

Thanks to everyone for your help.

user_18423500
Related