Support setting SSL mode (TLS version) for Microsoft SQL Server connections

[jelenv]

It looks like SSL mode config is not supported for MS SQL Server connections. When connecting to any DB with TLS enabled, for example in Azure, where TLS is required to be 1.2 or newer, the connection fails with the following error message:

Error: Adaptive Server connection failed
(server URL)
Msg: Reason: Login failed due to client TLS version being less than minimal TLS version allowed by the server.

Table Plus version: 1.2.4 (260)
OS: Ubuntu 24.10 x64

I have tried to configure the ssl mode in ~/.tableplus/settings/connections.json, by default it's "ssl-mode": -1,, however it always resets back to -1 (probably because other values are not implemented).

Is there some way how can I connect to DBs with TLS 1.2+ on Linux?
If not, please consider this feature for implementation.

If anyone else wants it too, please give this a thumbs up.

[hieulw]

I have same issue, ended up switch to DBeaver for now.

[syahzuan]

Following. Encountered the same issue.

[DDoctorzeus]

I think this might be a Linux-specific issue:

Environment

• Arch Linux
• TablePlus package: tableplus 0.1.308-1
• TablePlus binary: /opt/tableplus/tableplus
• OpenSSL: 3.6.3
• Microsoft sqlcmd and other SQL clients connect successfully to the same server
• Server: Azure SQL / MSSQL on TCP 1433

Problem

TablePlus fails with:

Reason: Login failed due to client TLS version being less than minimal TLS version allowed by the server.

Other clients on the same machine connect successfully.

strace findings

I traced TablePlus with:

strace -f -e trace=network -s 256 -o /tmp/tableplus.trace \
  /opt/tableplus/tableplus

Relevant sanitized section:

socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 24

connect(24,
  {sa_family=AF_INET, sin_port=htons(1433), sin_addr=inet_addr("<AZURE_SQL_IP>")},
  16
) = -1 EINPROGRESS (Operation now in progress)

getsockopt(24, SOL_SOCKET, SO_ERROR, [0], [4]) = 0

sendto(24,
  "\20\1\1\210...",
  392,
  MSG_NOSIGNAL,
  NULL,
  0
) = 392

recvfrom(24,
  "\4\1\1J\0\0\1\0",
  8,
  MSG_NOSIGNAL,
  NULL,
  NULL
) = 8

recvfrom(24,
  "...Reason: Login failed due to client TLS version being less than minimal TLS version allowed by the server...",
  322,
  MSG_NOSIGNAL,
  NULL,
  NULL
) = 322

The first byte of the 392-byte packet sent by TablePlus is:

0x10

which appears to be a TDS LOGIN7 packet.

I do not see a TDS PRELOGIN packet (0x12) or TLS handshake on this connection before the LOGIN7 packet is sent.

The observed flow therefore appears to be:

TCP connect
→ TDS LOGIN7 (0x10)
→ server returns TLS minimum-version error

rather than:

TCP connect
→ TDS PRELOGIN (0x12)
→ TLS negotiation
→ LOGIN7

Since sqlcmd and other MSSQL clients work from the same Arch machine, this appears specific to the TablePlus Linux MSSQL/TDS implementation.

Is there currently a way to enable/force TLS 1.2+ for MSSQL connections in TablePlus Linux, or is PRELOGIN/encryption negotiation not implemented correctly in build 308?

[nangtrongvuon]

Hi @jelenv, sorry it's taken a while but I've fixed the app so the next release should connect to SQL Servers where TLS is 1.2 or newer now.

[jelenv]

@nangtrongvuon Thank you, I may give it a go again