Server is detected with Weak SSL/TLS Key Exchange on Port 1433 which is used by application SQLSRVR.EXE - Microsoft Q&A (2024)

FAQs

How do I fix a weak SSL/TLS key exchange vulnerability? ›

Click the Start button on the local machine and type “CMD” into the search programs and files field. Enter “Telnet IP-address 1433” in the Command Prompt. If port 1433 is not open, it will immediately return an error. We will be able to connect to the MS-SQL server if port 1433 is open.

SQL Server can support different TLS (Transport Layer Security) versions across various editions. The TLS versions supported by SQL Server may vary depending on the SQL Server version and the Windows operating system in use. In general, SQL Server 2008 and later versions typically support TLS 1.0, TLS 1.1, and TLS 1.2.

To fix this scenario, you can either trust the server certificate or bypass the certificate validation. To trust the server certificate, add it to the list of trusted root certificates of your application or the system. In Windows, you can use the Certificate Manager tool (certmgr.

By default, Microsoft Windows enables the Windows Firewall, which closes port 1433 to prevent Internet computers from connecting to a default instance of SQL Server on your computer. Connections to the default instance using TCP/IP aren't possible unless you open port 1433.

TCP port 1433 is the default port for communication between Microsoft SQL Server and its applications. SQL Server powers many of the world's top data-driven solutions, and port 1433 is widely used to connect to the database.

Unfortunately, SQL Server is not secured by default. Other machines communicating with it over TCP Port 1433 are doing so in clear-text, and a sniffer like WireShark could intercept those communications. For a long time, clear-text inside of a network's perimeter was commonplace.

How to check if a port is open or not? ›

On a Windows computer

Press the Windows key + R, then type "cmd.exe" and click OK. Enter "telnet + IP address or hostname + port number" (e.g., telnet www.example.com 1723 or telnet 10.17. xxx. xxx 5000) to run the telnet command in Command Prompt and test the TCP port status.

Port number 1433 is commonly used for MySQL server.

Go to https://browserleaks.com/tls to check your TLS version. This site will evaluate your current web browser (including Chrome, Safari, and Edge) and report which versions of TLS it supports. Under "Protocol Support," you'll see a list of all TLS versions, from TLS 1.0 to TLS 1.3.

To identify if SQL SERVER database is SSL enabled or not, run the following query: "SELECT session_id, encrypt_option FROM sys. dm_exec_connections". It should be run by Database Administrator.

The fix is easy: In the windows search box, near the Windows Start button, type Internet Options. Open the result Internet options - control panel. Then click the Advanced tab. Scroll down in the long list to security and make sure use TLS 1.2 is checked.

Configure a Port to Use the TLS/SSL Certificate

Select the Windows Start button. Enter netsh in Search, and select Enter. Replace the certhash value with the certificate thumbprint value without the spaces. Modify the ipport value if you want to use a port other than the default port (443).