Summary

Recommendations when legacy cryptographic protocols are disabled.

Synopsis

If legacy cryptographic protocols are disabled the installer may be unable to create a database connection. For example, under particular circumstances you may be using Windows 2008 R2 (and above) which has support for TLS 1.2. This implies you are working with what Microsoft addressed in SQL 2014 SP1?s support for TLS 1.2 in its CU1 update. When you run the installer with default SQL Connection settings created by InstallShield at runtime there is error:

There was an error logging in to Microsoft SQL Server.
Error: [DBNETLIB][ConnectionOpen (SECCreateCredentials()).]SSL Security error.
(18)

Discussion

This applies to Basic MSI project types.

In the scenario presented the legacy TLS 1.0 and TLS 1.1 (and prior SSLs) are all disabled. Disabling cryptographic protocols is commonly done in GPO (Group Polciy Object) or the Registry.

Using InstallShield the default settings may not meet your needs. To address this connection problem you can change the driver name in the AdoDriverName column of the ISSQLDBMetaData table using the Direct Editor so that you can use a different driver for InstallShield to establish a connection.

To address the situation trying to support TLS 1.2 using the Direct Editor set the property to "sqlncli11". It is expected you can only specify one driver name at a time.

If you continue to have an issue you might be able to audit the login via a SQL Tool such as "SQL Server Profiler", which reports all activity on a SQL Server. SQL Server Profiler is a rich interface to create and manage traces and analyze and replay trace results. Reference:

SQL Server Profiler

Workaround

Steps to configure your InstallShield installation project so that your installation uses the SQL Server Native Client 11 ODBC driver:

1. In the View List under Additional Tools, click Direct Editor.
2. In the Tables explorer, click the ISSQLDBMetaData table.
3. In the ISSQLDBMetaData column, find the MSSQLServer row.
4. Replace the value of the AdoDriverName column with the following:

sqlncli11

Additional Information

Please see the HelpNet article:

Requirements for Connecting to Instances of SQL Server Express LocalDB

Related Documents

See the Microsoft Blogs:

SQL Server Release Services

SSL Security error [DBNETLIB]ConnectionOpen (SECDoClientHandshake())

Article

TLS 1.2 support for Microsoft SQL Server . This article provides information about the updates that Microsoft is releasing to enable TLS 1.2 support for SQL Server 2016, SQL Server 2008, SQL Server 2008 R2, SQL Server 2012, and SQL Server 2014. This article also lists supported client providers.