1

Overview

We have a .NET Core Web API (.Net 6) deployed as an Azure Web App & we are attempting to connect to an On Prem SQL Server. It is very simple API. One endpoint. It simply connects to our On Prem DB, retrieves & returns a single value.

We took the exact same API & deployed it:

  1. To a Azure Web App deployed with a Windows App Service Plan.
  2. To a Azure Web App deployed with a Linux App Service Plan.

We have whitelisted the Outbound IP's of the corresponding Azure Web API's to avoid firewall issues.

The Problem

The API deployed to the Window App Service Plan has no issue connecting and querying the On Prem Database. The same API deployed to the Linux App Service Plan, however, results in the following error when we attempt to connect & run a query:

A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 31 - Encryption(ssl/tls) handshake failed)

Does anyone have any idea why we would be running into issues on Linux and not on Windows and what we might need to look at in order to allow both access?

Related Posts

BryceBy
  • 208
  • 5
  • 16
  • What certificate is your server using? Why should your Linux app trust the CA that signed that cert? – mason Sep 12 '22 at 20:39
  • No certificate. – BryceBy Sep 13 '22 at 17:33
  • You have no certificate? In order to use encryption with SQL Server, it's a requirement. You need to get one that's been signed by a CA that the clients trust. – mason Sep 13 '22 at 17:51
  • refer this thread https://stackoverflow.com/questions/73764798/azure-app-service-cant-connect-to-local-db-exposed-via-public-ip/73795411#73795411 – Mohit Ganorkar Sep 23 '22 at 05:41

1 Answers1

0

"Encryption(ssl/tls) handshake failed..."

This means something else. Just add the below code to the Docker file. And test it at local first. Then you can try at Azure.

RUN sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /etc/ssl/openssl.cnf
RUN sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /usr/lib/ssl/openssl.cnf
RUN sed -i 's/DEFAULT@SECLEVEL=2/DEFAULT@SECLEVEL=1/g' /etc/ssl/openssl.cnf
RUN sed -i 's/DEFAULT@SECLEVEL=2/DEFAULT@SECLEVEL=1/g' /usr/lib/ssl/openssl.cnf
Jeremy Caney
  • 7,102
  • 69
  • 48
  • 77
Meric
  • 1
  • 1