Left with 0 client certificates to choose from when accessing SSRS management.

Question

Environment:

Reporting Services running on a SQL Server 2008 R2 SP3 installation on a Windows 2008 server with .Net 4.6.1 installed and .Net 3.5 enabled as feature. IIS, database and reporting service all in the local machine (custom login URL in a different machine but seems that this is unrelated).

Changes done:

Due to security reasons we are force to move to TLS 1.2 so we did with IISCrypto enabling just TLS 1.2

Outcome:

From this moment we get an error only when trying to access the Report Management site. On the browser we get an error 500 saying:

The underlying connection was closed: An unexpected error occurred on a receive

On the SSRS logs we can see the following exception:

System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a receive. ---> System.ComponentModel.Win32Exception: The client and server cannot communicate, because they do not possess a common algorithm

The callstack starts on the ReportServer OnInit() so it is failing right starting away and the error happens on the Reporting Services initialization.

Enabling traces on the .Net Framework I found the following messages where it is shown that the fail happens when SSRS calls its own web services:

System.Net Information: 0 : [5076] HttpWebRequest#38854310 - Request: POST /ReportServer/ReportService2010.asmx HTTP/1.1

System.Net Information: 0 : [4124]

SecureChannel#52830003::.ctor(hostname=themachineshostname, #clientCertificates=0)

System.Net Information: 0 : [4124] Enumerating security packages:

System.Net Information: 0 : [4124]     Negotiate

System.Net Information: 0 : [4124]     NegoExtender

System.Net Information: 0 : [4124]     Kerberos

System.Net Information: 0 : [4124]     NTLM

System.Net Information: 0 : [4124]     Schannel

System.Net Information: 0 : [4124]     Microsoft Unified Security Protocol Provider

System.Net Information: 0 : [4124]     WDigest

System.Net Information: 0 : [4124]     TSSSP

System.Net Information: 0 : [4124]     pku2u

System.Net Information: 0 : [4124]     CREDSSP

System.Net Information: 0 : [4124] SecureChannel#52830003 - Left with 0 client certificates to choose from.

System.Net Information: 0 : [4124] AcquireCredentialsHandle(package = Microsoft Unified Security Protocol Provider, intent  = Outbound, scc = System.Net.SecureCredential)

System.Net Error: 0 : [4124] AcquireCredentialsHandle() failed with error 0X80090331.

Things already checked:

The certificate in use is still valid and it's signature chain is placed in the proper "Intermediate" and "Root" stores.

Running the Application Pool as an administrator does not help.

Using a custom signed certificate generated from IIS does not help.

Important: The issue only happens on the Reporting Services Management site, the reports work fine

Next Steps

Any ideas on what else to try? Is there a way to know why the security packages where not selected?

Update

The issue is not related to TLS1.2 as enabling TLS 1 again I get the same error. I'm guessing that the login URL is somehow involved.

Murdocca

Can you test this using latest version of curl? curl -v --tlsv1.2 --cert myclientcert.pem https://<yoururl>, you want to make sure that it is not a browser related issue and debug it using curl first – Sackman

Thanks for the comment. What should I use as a client cert? Anything goes? – Murdocca

So you have not enabled client certificate authentication on the server? If so try without the --cert first – Sackman

I got exactly the same 500 error. The error happens when Reporting Services makes local calls to its own Web Services as far as I know so I guess it is not related with the client being used. – Murdocca

Anyway thanks to your comment I saw the question was laking details, I improved it. Thanks! – Murdocca

See if this helps #26742554 – Sackman

Do you have the certificate installed in both report manager and the web service? Is only https enabled or is http still enabled also? I assume your security protocols in the registry are only allowing TLS 1.2 for both client and server? Did you make any changes to your report server config file? – Banana

There is only one server, IIS, SQL and reporting are all located in the same box. Only https. Only 1.2. I've been trying hundreds of things so I guess I've changed every file in the system :D – Murdocca

@thomas: do I need to have the same certificate in SSRS and in the IIS providing custom login UI? – Murdocca

Answer 1

Let’s ensure 2 things are set properly in the registry (on both your Report Server and IIS custom login server). Reboot is required after reach setting change (do one at a time to see what works).

TLS 1.2 Client/Server Enablement in Registry

Go to HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL and ensure TLS 1.2 is enabled and the other providers are disabled. If TLS 1.2 is not present create it. Details here

Ensure UseStrongCrypto is Enabled for .NET

Go to here and ensure strong crypto is enabled.

Note: I am on mobile device so hard to type an in depth answer. If these things work for you I can add more detail into the answer later.

Banana

Thanks for the answer, this is already verified. TLS 1.2 is working fine when accessing reports. The issue happens only with the ReportManager. – Murdocca

Something with TLS 1.2 is causing your error. The “do not possess a common algorithm” is what leads me to believe that because I have experienced the issue before as well. Is TLS 1.2 enabled for the Client key in the registry? And what about the .NET strong crypto. The Report Manager is acting as a client (written in .NET) that connects to the Report Service URL (the “server” in this case). If your local machine can connect the the web service URL but Report Manager cannot that leads me down the road I posed in the answer. – Banana

I've double checked it and it is correctly set. By the way,how can the Report Manager (written in .Net 2 work with TLS 1.2 without changing its code?) – Murdocca

Good question. You may need a hotfix since you are on 2008 R2. Does this answer provide any insight/progress? https://mcmap.net/q/914971/-how-to-enable-tls-1-2-for-api-call-in-asp-net-2-0-application – Banana