Blog

PHP sqlsrv on Ubuntu 24.04: unsupported protocol

Fix "SSL Provider: unsupported protocol" from PHP sqlsrv on Ubuntu 24.04, for one site only, without lowering TLS for the whole server.

26 October 20262 min readKLYRN

The error

We moved a game community site from an old CentOS server to Ubuntu 24.04. Its accounts live in a Microsoft SQL Server database on another machine. After the move the site answered with this:

[Microsoft][ODBC Driver 17 for SQL Server]SSL Provider:
[error:0A000102:SSL routines::unsupported protocol]

Why it happens

Ubuntu 24.04 ships OpenSSL 3, and its default refuses TLS 1.0 and 1.1. An older SQL Server that offers only those versions cannot complete the handshake. The old server ran an older OpenSSL that still allowed them.

The real fix is on the database side. Patch the SQL Server so it speaks TLS 1.2. Until then, the site needs a way in.

Install the driver and the extensions

ACCEPT_EULA=Y apt-get install msodbcsql17 unixodbc-dev php8.1-dev php-pear
pecl -d php_suffix=8.1 install sqlsrv-5.12.0 pdo_sqlsrv-5.12.0

Use the same ODBC driver version the old server ran. Ours ran 17, so we kept 17. Then load both extensions only for the site that needs them.

Allow old TLS for one site only

Do not lower the system OpenSSL policy. That weakens every connection the server makes. Point the one PHP-FPM service at its own OpenSSL file instead.

openssl_conf = openssl_init
[openssl_init]
ssl_conf = ssl_sect
[ssl_sect]
system_default = tls_sect
[tls_sect]
MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=0

Then add a systemd drop-in for that site's PHP service with Environment=OPENSSL_CONF= and the file's path. Restart the service.

Check it took effect

Run php -m for that PHP version and look for sqlsrv in the list. A site that still says the extension is missing is reading another extension folder, so check which one its service loads.

Then confirm the database port answers from the new server before you blame TLS. A firewall that only allowed the old address gives a similar connection error.

The result

The site loaded again with the same page size as on the old server, within three bytes. Every other site kept the strict default.

In KLYRN each account runs its own PHP-FPM service with its own extension list. That makes a fix like this possible for one site. The PHP guide covers versions and extensions.