MS Ai Insider

New blog articles in Microsoft Community Hub

How to Enforce TLS Versions and Inspect SSL Certificates for Secure Python Connections to Azure SQL Database

Posted by

ailona

–

June 5, 2025

Troubleshooting connection issues between Python and Azure SQL Database? Discover how to use Python’s SSL library to enforce specific TLS versions, inspect cipher suites, and verify certificates, ensuring secure and compatible connections with Azure SQL DB via ODBC Driver 18. :

Troubleshooting TLS and Cipher Suites with Python for Azure SQL DB

If you’ve ever struggled connecting Python apps to Azure SQL Database, you’re not alone. Recently, a tricky issue popped up involving TLS versions and cipher suites mismatches when using Python with ODBC Driver 18. This post breaks down what happened and how to fix it using Python’s SSL library.

What’s New?

The challenge came from a customer’s connection failures to Azure SQL DB due to mismatched TLS versions and cipher suites. The root cause? Python’s default SSL settings didn’t align with Azure’s requirements.

Thankfully, Python’s ssl module offers granular control over TLS versions and cipher suites. By creating a custom TLS context, you can enforce specific security protocols and inspect connection details.

Major Updates: The Python Script That Saves the Day

Here’s the gist: the script creates an SSL context that forces TLS 2 and verifies the server’s certificate. It then connects to Azure SQL Gateway on port 1433 and prints out the TLS version, cipher suite, and certificate details.

import ssl
import socket

host = 'servername.database.windows.net'
port = 1433

context = ssl.create_default_context()
context.minimum_version = ssl.TLSVersion.TLSv1_2
context.maximum_version = ssl.TLSVersion.TLSv1_2
context.check_hostname = True
context.verify_mode = ssl.CERT_REQUIRED
context.load_default_certs()

with socket.create_connection((host, port)) as sock:
    with context.wrap_socket(sock, server_hostname=host) as ssock:
        print("TLS connection established.")
        print("TLS version:", ssock.version())
        print("Cipher suite:", ssock.cipher())
        cert = ssock.getpeercert()
        try:
            cn = dict(x[0] for x in cert['subject'])['commonName']
            print(f"\nCertificate CN: {cn}")
        except Exception as e:
            print("Error extracting CN:", e)
        print("Valid from:", cert.get('notBefore'))
        print("Valid until:", cert.get('notAfter'))

Why This Matters

By explicitly setting minimum_version and maximum_version to TLS 2, you avoid connection failures caused by unsupported TLS versions. Inspecting the cipher suite helps confirm that the negotiation matches Azure’s security policies.

Moreover, verifying the certificate’s common name and validity dates ensures your app connects to the right server securely.

“Using the library SSL in Python allows to establish a TLS/SSL context where I can control the TLS version and specify or inspect the cipher suite.”

“I was able to enforce a specific TLS version by setting minimum_version and maximum_version.”

Final Thoughts

If you’re working with Python and Azure SQL Database, don’t overlook TLS and cipher suite compatibility. This simple Python script can save hours of debugging and improve your app’s security posture.

Feel free to tweak the script for TLS 3 or other settings as Azure evolves. Happy coding!

Learn to create a TLS/SSL context in Python to control security protocols.

Understand how to specify minimum and maximum TLS versions for connections.

Inspect negotiated cipher suites to troubleshoot compatibility problems.

Retrieve and analyze certificate details like Common Name and validity period.

Use socket programming combined with SSL to test Azure SQL Database connectivity on port 1433.

From the New blog articles in Microsoft Community Hub