SQL Server SSL连接报错：服务器TLS1.0不被客户端TLS1.2接受

使用SMSS 2014 (12.0.2000.8) 及 SMSS 2016，JDBC驱动为mssql-jdbc-8.2.2.jre11，编译代码后出现SSL连接错误：

com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "The server selected protocol version TLS10 is not accepted by client preferences [TLS12]". ClientConnectionId:6d1bbfa9-5e53-47fa-b07e-42f6df640d65
        at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:2998)
        at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1884)
        at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:2558)
        at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:2216)
        at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:2067)
        at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1204)
        at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:825)
        at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:677)
        at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:251)
        at Connector.initializeConnection(Connector.java:20)
        at Connector.<init>(Connector.java:10)
        at mainApp.main(mainApp.java:5)
Caused by: javax.net.ssl.SSLHandshakeException: The server selected protocol version TLS10 is not accepted by client preferences [TLS12]     
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:363)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:319)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:310)
        at java.base/sun.security.ssl.ServerHello$ServerHelloConsumer.onServerHello(ServerHello.java:951)
        at java.base/sun.security.ssl.ServerHello$ServerHelloConsumer.consume(ServerHello.java:873)
        at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:478)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:456)
        at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:199)
        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1383)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1296)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:416)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:388)
        at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:1802)
        ... 10 more

已通过注册表确认系统启用TLSv1.2，请求解决连接问题。

1. 升级SQL Server服务端补丁 #

SQL Server 2014/2016原生版本不支持TLS1.2，需安装对应补丁：

• SQL Server 2014：安装Service Pack 3 (SP3) 及后续累积更新
• SQL Server 2016：安装Service Pack 2 (SP2) 及后续累积更新
• 安装完成后重启SQL Server服务，确保服务端优先使用TLS1.2协议

2. 修改JDBC连接字符串 #

在连接字符串中强制指定TLS1.2协议，同时可临时调整SSL验证策略：

• 强制使用TLS1.2的示例连接字符串：

String url = "jdbc:sqlserver://your-server:1433;databaseName=your-db;encrypt=true;sslProtocol=TLSv1.2;user=your-user;password=your-pass";

• 若测试时仍报错，可临时添加trustServerCertificate=true跳过证书验证，排查是否为证书兼容性问题

3. 调整JVM协议参数 #

通过JVM参数放宽客户端支持的TLS协议范围，允许与服务端协商兼容版本：

• 启动应用时添加以下参数：

-Djdk.tls.client.protocols=TLSv1.2,TLSv1.1,TLSv1

4. 验证JDBC驱动兼容性 #

mssql-jdbc-8.2.2.jre11需配合已升级补丁的SQL Server使用，若服务端未更新补丁，驱动可能无法正常协商TLS1.2，优先完成服务端补丁升级后再测试

内容的提问来源于stack exchange，提问作者PA1N