DCDIAG error - tls protocol defined fatal alert code is 20

[TwistedHelixis]

Hi all,

 

Just about to migrate our only DC from 2012r2 to 2019. Ran DCDIAG and get the following error,

 

systemlog event id 0x00009017 a fatal alert was received from the remote endpoint the tls protocol defined fatal alert code is 20

 

Cant find much online about alert code 20 or event id 0x00009017

 

Any ideas?

[colly72]

Hi all,

 

Just about to migrate our only DC from 2012r2 to 2019. Ran DCDIAG and get the following error,

 

 

 

Cant find much online about alert code 20 or event id 0x00009017

 

Any ideas?

 

Could be to do with incompatible Cipher Suites - does this help? https://techcommunity.microsoft.com/t5/iis-support-blog/schannel-error-state-960-tls-fatal-error-code-20/ba-p/722663

[TwistedHelixis]

Could be to do with incompatible Cipher Suites - does this help? https://techcommunity.microsoft.com/...20/ba-p/722663

 

Thanks for taking the time to find that.

 

I have no idea if its to do with Cipher Suites. I don't really want to follow the steps in that link as its about fixing a web server and not a domain controller. I don't want to install the patch as that is for a network load balancing issue.

 

Totally stumped and don't know what to do.

 

Do I take good backups and carry on with the DC migration?

[colly72]

You could make the group policy changes indicated in the link to see if it resolves it without installing any patch. Change it back again if you get any issues....

 

I wouldn't migrate/upgrade any DC's while they are any errors in DCDIAG personally, i've had too many scary moments with this sort of thing!

[TwistedHelixis]

Thought I would fire up a test VM host server and restore a backup of the DC vm, except when I run DCDIAG on this I am not getting the error.

 

The only difference I can think of, is the restored test VM has Novembers or Decembers 2022 Windows updates, whereas the live DC has Jan 2023 updates

 

EDIT: on the backup VM in the dcdiag output I can see it has skipped a few tests, possibly because its on a test host without lan connection.

Edited January 17, 2023 by TwistedHelixis

[TwistedHelixis]

this was the actual original error, in case it helps.

 

 

Started test systemlog

An error event occurred. EventID: 0x00009017

Time Generated: 01/16/2023 14:04:13

Event String: A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.

......................... server-DC-01

failed test SystemLog

Edited January 17, 2023 by TwistedHelixis

[TwistedHelixis]

You could make the group policy changes indicated in the link to see if it resolves it without installing any patch. Change it back again if you get any issues....

 

Just tried that but stuck at 7: Make sure that this list matches the cipher suite list used in your load balancer.

 

But I don't have a load balancer.

 

I could do the following steps:

 

General recommendation:Move TLS_RSA chiper suites to the top

Copy TLS_ECDHE ones after them

Remove these two chiper suites as they have known interoperability issues:TLS_DHE_RSA_WITH_AES_128_CBC_SHATLS_DHE_RSA_WITH_AES_256_CBC_SHA

 

But I'm not happy making changes to these cipher lists, as I don't know what the knock on will be.

Edited January 17, 2023 by TwistedHelixis

[colly72]

Is replication between your DCs working OK? Have you migrated from FRS to DFSR?

[TwistedHelixis]

Is replication between your DCs working OK? Have you migrated from FRS to DFSR?

 

We only have one DC

 

Migrated to DFSR a while back, but will run script test on it later and post back.

[TwistedHelixis]

Just ran dfsrmig /getmigrationstate and it reported "Eliminated" which means it is on DFS-R

[TwistedHelixis]

Not made any changes, just ran DCDIAG and that error is no longer displayed. Very odd.

I now have some other errors listed, but I will work through those one by one.

[MichaelZahn]

The error you're seeing (event id 0x00009017 with TLS alert code 20) usually points to a "Bad Certificate" issue. It could mean that the remote endpoint is rejecting the certificate presented by your DC.

Here’s what you can try:

Check Certificates: Ensure your DC's certificate is valid and trusted.

TLS Settings: Verify that TLS/SSL settings are compatible on both ends.

Event Logs: Look for more details in the logs around the error time.

Update Systems: Make sure all systems are fully patched.

If the issue persists, consider checking Group Policy settings or recreating the certificate.