-
Title
Unable to connect to SharePoint Online - The underlying connection was closed - Could not create SSL/TLS secure channel. -
Description
You may experience one of following errors when attempting to connect to SharePoint Online in Content Matrix:
-
Cause
Disablement of Transport Layer Security (TLS) 1.0 and 1.1 protocols in the Microsoft 365 service as explained here .
-
Resolution
In order to meet the Azure Front Door requirements, the operating system has to support TLS 1.2 and TLS cipher suite settings have to be adjusted to match the requirements.
1) Enable TLS 1.2 at Operating System level
If you are using Windows 8, Windows 7 Service Pack 1 (SP1), Windows Server 2012 or Windows Server 2008 R2 SP1, see the following solutions.
- The Easy Fix Tool can add TLS 1.1 and TLS 1.2 Secure Protocol registry keys automatically. For more information, see Update to enable TLS 1.1 and TLS 1.2 as default secure protocols in WinHTTP in Windows.
- For Windows 8, install KB 3140245, and create a corresponding registry value.
- For Windows Server 2012, the Easy Fix Tool can add TLS 1.1 and TLS 1.2 Secure Protocol registry keys automatically. If you're still receiving intermittent connectivity errors after you run the Easy Fix Tool, consider disabling DHE cipher suites. For more information, see Applications experience forcibly closed TLS connection errors when connecting SQL Servers in Windows.
2) Enable and Prioritize TLS Cipher Suites
Even after you enable TLS 1.2, it's important to enable and prioritize the following cipher suites to make sure that the cipher suites settings match Azure Front Door requirements:
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
Note: For one-off scenarios, some customers have had success enabling these cipher suites through the 3rd party tool, Nartac Software - IIS Crypto
Note: For a broader approach, deploy a group policy as described in Configuring TLS Cipher Suite Order by using Group Policy to prioritize the above cipher suites to the beginning of the list.
3) Changes to the TLS cipher suite order will take effect on the next boot. Until restart or shutdown, the existing order will be in effect.
Note: Alternatively, customer can open a Support request with Microsoft to investigate this TLS issue as this issue is occurring from the Microsoft side.
Sources:
Microsoft articles on https://docs.microsoft.com
MAIN ARTICLE: Authentication errors occur when client doesn't have TLS 1.2 support
Manage Transport Layer Security (TLS)