sql-server - 在 dockerized C sharp 微服务中播种/迁移数据时 SSL_ERROR_SSL MSSQL 握手失败

Question

尝试从 MSSQL 数据库容器中的 C# (C Sharp) 微服务​​播种/迁移数据(图片为 mssql-server-linux:2017-latest)...

连接成功

异常信息如下

exampleapi_1 | fail: Microsoft.EntityFrameworkCore.Database.Connection[20004]
exampleapi_1 | An error occurred using the connection to database 'Domain.exampleManagement.Docker' on server 'DOMAIN-DB'.
exampleapi_1 | fail: Puma.exampleManagement.API.Program[0]
exampleapi_1 | An error occurred while migrating or seeding the database.
exampleapi_1 | Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 35 - An internal exception was caught)
exampleapi_1 | ---> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception.
exampleapi_1 | ---> Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL.
exampleapi_1 | ---> Interop+Crypto+OpenSslCryptographicException: error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol

我可以传递任何类似于 ACCEPT_EULA 的环境变量来禁用 SSL 吗？在连接字符串中，我已将 Encrypted 更新为 False。另外，我可以将连接超时更新为 600。我是否需要从此 docker 镜像创建自定义 Dockerfile 作为基础？我应该在这个 Dockerfile 中添加以下行吗？

RUN sed -i "s|TLSv1.2|TLSv1.0|g" /etc/ssl/openssl.cnf

如果 Dockerhub 存储库中已经有启用 SSL 的标签，请分享它的链接

Answer 1

这个解决方法最终帮助我使用了 mcr.microsoft.com/dotnet/runtime:5.0-buster-slim docker 图像:

RUN sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /etc/ssl/openssl.cnf
RUN sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /usr/lib/ssl/openssl.cnf
RUN sed -i 's/DEFAULT@SECLEVEL=2/DEFAULT@SECLEVEL=1/g' /etc/ssl/openssl.cnf
RUN sed -i 's/DEFAULT@SECLEVEL=2/DEFAULT@SECLEVEL=1/g' /usr/lib/ssl/openssl.cnf