Search code examples
ssltomcatiisschannel

The TLS protocol defined fatal alert code is 70

I'm trying to access an SSL URL from a Windows browser to another machine running Tomcat and I am seeing error 36887 from Schannel in the System event log on the Windows machine with this description:

The TLS protocol defined fatal alert code is 70

According to MS documentation: MS documentation

I've turned up Schannel logging (max=7) on the Windows machine and I can see that an SSL handshake was negotiated correctly, this from the event log:

An SSL server handshake completed successfully. The negotiated cryptographic parameters are as follows.
  Protocol: TLS 1.2
  CipherSuite: 0xC028
  Exchange strength: 256

This seems to contradict the code 70 error.

Cipher suite 0xC028 is TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384. I've checked on the Tomcat machine and can see that this is available, and TLS1.2 is also enabled on both machines so the successful handshake makes sense.

The process ID associated with the code 70 error belonged to lsass.exe - my Windows knowledge is quite limited so I have no idea what that does.

I can find nothing in the catalina.out log on the Tomcat machine, the code 70 seems to be happening before the request is actuall sent. I am certain that the certs are all configured correctly as I can access the URL successfully from other machines.

How can I progress from here?

Solution

  • The issue turned out to be that one of our client apps was using .NET 4.5.2 and defaulting to TLS1.1, which had been disabled at the server end by some patching. Ultimately a .NET update to 4.7.2 fixed the issue.