Registering a SQL Server instance for monitoring with DPA fails with the message "TLS handshake failed"

Registering a SQL Server database instance for monitoring with DPA fails, and the DPA registration wizard displays the message "TLS handshake failed. Could not connect to the server using SSL."

This is accompanied by the following error in the wizard.log:

"The server selected protocol version TLS10 is not accepted by client preferences [TLS13, TLS12]"

This happens because the server (for example, a server running SQL Server 2008 R2) is not patched to a version that supports newer TLS 1.2 or 1.3, which DPA requires for secure communication. This requirement is inherited from the JDK shipped with DPA, which disables TLS 1.0 and 1.1 by default. This occurs in JDK 11.0.11 and later for security reasons.

To resolve this issue, patch SQL Server to a newer Service Release or Cumulative Update that contains support for TLS 1.2 or later. See this Microsoft KB article for information about each SQL Server version.

If you cannot apply the resolution, you can use the following as a workaround and continue using TLS 1.0. (This workaround is not recommended because it reduces security.)

1. Open the following file in a text editor (or the corresponding file if you are using custom Java):

   DPA_Home\iwc\jre\conf\security\java.security

2. Find jdk.tls.disabledAlgorithms.

3. Remove TLSv1, TLSv1.1. Then save the changes.

4. Restart DPA.