Error 27502. Could Not Connect To Microsoft SQL Server Using TLS 1.2 (Transport Layer Security 1.2)

Summary

Information about establishing SQL connection over TLS 1.2 using InstallShield

Synopsis

Including SQL scripts in a Basic MSI project is organized by connection. No script can run on a server until a connection has been established. InstallShield requires a SQL Server ODBC driver or OLE DB provider to use the SQL Scripting functionality.

Discussion

If you want to use the new capabilities that Microsoft SQL Server offers, and you want to employ TLS 1.2 (Transport Layer Security 1.2) you must configure InstallShield to use a driver that supports them. Otherwise, InstallShield SQL connection will not work.

The default ISSQLDBMetaData entry for Microsoft SQL Server is configured to use a SQL Server OLE DB provider. A change is required to use a different OLE DB provider and you have to change the value of the AdoDriverName column specific to that provider. Since connection strings for ODBC drivers are different from OLE DB providers, more settings may need to be changed in your InstallShield project. This article is intended to provide the manual settings required in the IDE when targeting connections through TLS 1.2.

This is a non-exhaustive list. Some of the various connection issues you may experience are described below. Each one may require any or all of the specific settings required for TLS found in the Additional Information section below:

Provider cannot be found. It may not be properly installed.
A network-related or instance-specific error has occurred while establishing a connection to SQL Server (-2146893007).
ODBC Driver 11 for SQL Server invalid connection string (0).
SQL Server Native Client 11.0 SSL Provider. The client and server cannot communicate because they do not possess a common algorithm.
SQLState: '08001' SQL Server Error 18 - See KB Article Installer is unable to create a database connection - working with TLS 1.2

After the expected TLS settings are established and enabled on the server and client in your environment manually and you have added a connection through the InstallShield IDE change the InstallShield project manually to allow connection.These changes are specific to allow the SQL connection to use ODBC Driver for SQL Server compliant with TLS 1.2.

Note: The table ISSQLDBMetaData is populated with data after a New SQL Connection is added in the IDE. Reference: SQL Scripts View

1) Modify the Property Manager specifying a new value. In this step navigate to Behavior and Logic > Property Manager. Locate the property IS_SQLSERVER_NETLIB_MS and change its value.

Property Manager

IS_SQLSERVER_NETLIB_MS

Network=DBMSSOCN

2) Using the Direct Editor change all of the data specified below in the ISSQLDBMetaData table.

ISSQLDBMetaData table

AdoDriverName	{ODBC Driver 11 for SQL Server}
AdoCxnDriver	Driver=
AdoCxnDatabase	Database=
AdoCxnUserID	Uid=
AdoCxnPassword	Pwd=
AdoCxnWindowsSecurity	Trusted_Connection=Yes

Additional Information

The following is a list of details implied to be established when working with TLS 1.2.

SQL Server version and cumulative update/patched per Microsoft specification. Reference KB #3135244.
.Net 4.5 or newer installed
TLS/SSL settings established found here: TLS/SSL Settings
Ensure SQL server service is running on server
TLS 1.0 and TLS 1.1 disabled in the Registry
Certification authority with the hash algorithm as SHA 256
SQL Server Native Client drivers installed (see KB #3135244)
ODBC Driver for SQL Server installed (see KB #3135244)
Specific Operating System Updates with TLS 1.2 support established (see KB #3135244)
SChannel key block - restrict protocol communication on servers to TLS 1.2 only in the Registry
Ensure the SChannel data in the Registry under ..\SCHANNEL\Protocols\TLS 1.2 includes both Client and Server (Image below)

Note: When working with or changing SChannel key block or any of the GPO (Group Policy) settings it is recommended both server and client be restarted.

SChannel Key Block Registry Settings For TLS 1.2

ACordner · ‎Oct 12, 2019

After updating my installer according to these instructions, and installing the ODBC 11 driver, I was able to get by the 27502 error, only to run into the 27504 error (minimum version of SQL Server not met), which I had resolved a few years earlier in a previous version of our software. Since theere seems to be no log file output for the attempt to connect to SQL Server, it is impossible to know why the version of SQL Server is not correctly identified.

Fortunately, I was able to find the Microsoft OLE DB Driver 18.2.2 for SQL Server download, revert all of the above mentioned settings to the default values, then change the AdoDriverName field value to "MSOLEDBSQL" and problem solved!

https://www.microsoft.com/en-us/download/details.aspx?id=56730

I did have to create my own prerequisite for this installer, which may or may not be completely correct because I have never determined to proper way to know what return codes indicate a reboot is needed, but it does seem to work.

NikhilPatel · ‎Nov 22, 2023

Hi ACordner,

I am also facing same issue and I am using install shield 2020 R3 and in my case I need to connect to SQL Server from install shield I do have ODBC driver 17 and 18.3.2.1 installed.
I did what you suggested, but I am getting Error 27502, Data source name not found and no default driver specified.

Error 27502. Could Not Connect To Microsoft SQL Server Using TLS 1.2 (Transport Layer Security 1.2)