- Error number
- 10054
- Severity
- 20 (fatal: the connection ends; may indicate a serious problem)
- State
- 0
- Product
- Microsoft SQL Server Database Engine
- Versions
- Any SQL Server version reached over TCP/IP through SQL Server client drivers
- Category
- Connectivity
- Last reviewed
- 23 October 2026
On this page
What it means
Client error 10054 means the TCP connection to SQL Server was reset by the other side, most often during the pre-login or TLS handshake because client and server could not agree on TLS, or because the port is not a SQL Server T-SQL listener.
This page covers the client error 10054, the Windows Sockets error WSAECONNRESET: the remote end (or something in between) sent a TCP reset on a connection that was already open. It is not the SQL Server engine message 10054 in sys.messages ("The data value for one or more columns overflowed the type used by the provider"), which is unrelated.
The words "a connection was successfully established" matter: name resolution, routing and the port all worked, and the TCP connection opened. The reset came during the pre-login handshake (TCP Provider) or the TLS handshake (SSL Provider). Microsoft ties the SSL Provider form to TLS problems: no TLS version or cipher suite in common, a server certificate with a weak hash, or TLS_DHE cipher suite issues between Windows versions. A reset in the TCP pre-login can also mean the port is not a SQL Server T-SQL endpoint at all, which is how we reproduced it. If the reset comes later on a working connection, look at the network path (firewalls, load balancers, idle timeouts) as well.
Common causes
- The client and server have no TLS protocol version in common, for example an old driver that supports only TLS 1.0 or 1.1 against a server where they are disabled (documented by Microsoft).
- Matching TLS versions but no common cipher suite after cipher hardening on one side (documented).
- The certificate SQL Server uses has a weak hash algorithm such as MD5, which does not work with TLS 1.2 (documented).
- The connection string points at the wrong port, one that accepts TCP but is not a SQL Server T-SQL listener, such as a Service Broker or mirroring endpoint (reproduced).
- On busy servers running SQL Server 2017 or earlier, intermittent resets from delays in accepting connections (documented).
Diagnose it
Read-only These queries only read metadata and dynamic management views. They do not change data, permissions or configuration, so they are safe to run first.
Which TCP ports really accept T-SQL connections?
SELECT ip_address, port, type_desc, state_desc
FROM sys.dm_tcp_listener_states
ORDER BY type_desc, port;Connect only to ports with type_desc = TSQL (other than the dedicated admin port). A port listed as SERVICE_BROKER or DATABASE_MIRRORING resets client connections exactly like this error.
Which certificate does the instance use?
Microsoft suggests checking this entry to confirm the certificate and its thumbprint algorithm.
EXEC sp_readerrorlog 0, 1, N'loaded for encryption';The line names a self-generated certificate or the hash of a configured one. Check the configured certificate's thumbprint algorithm in the Certificates console; MD5, SHA224 or SHA512 causes the TLS 1.2 failure.
Do other clients connect with encryption?
SELECT net_transport, encrypt_option, auth_scheme, COUNT(*) AS connections
FROM sys.dm_exec_connections
GROUP BY net_transport, encrypt_option, auth_scheme;Encrypted TCP connections from other clients mean the server side of TLS works, which points to the failing client's driver or TLS settings.
Compare TLS settings on client and server
On both machines, Get-TlsCipherSuite lists the enabled cipher suites, and the registry keys under HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols show which TLS versions are disabled. A network trace showing a Client Hello with no Server Hello confirms a TLS mismatch.
How to fix it
Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.
Update the client driver to one that supports TLS 1.2 or later
Client or network sideMicrosoft lists ODBC Driver 17 or 18, OLE DB Driver 18 or 19, .NET Framework 4.6.2 or later (or any supported .NET), and JDBC 9.4 or later as safe baselines. Replace SQL Server Native Client and the old SQLOLEDB provider.
Use the right port
Client or network sideTake the T-SQL port from sys.dm_tcp_listener_states or the error log line Server is listening on, and correct the connection string or alias.
Replace a certificate that uses a weak hash
Changes configurationConfigure a certificate with a SHA256 thumbprint in SQL Server Configuration Manager, or clear the weak one (and remove Server Authentication from it in the Certificates console) so SQL Server falls back to a self-generated certificate, then restart the service.
Caution: Restarting the SQL Server service disconnects every session; schedule it.
Align TLS versions and cipher suites with your security team
Changes configurationMake sure client and server share at least TLS 1.2 and one cipher suite. Re-enabling TLS 1.0 or 1.1 is only a short-term workaround that Microsoft describes while components are upgraded; do not leave it in place.
Examples
A client pointed at a port that is not a T-SQL listener
Reproduced with sqlcmd and ODBC Driver 18 on 2026-10-23. Port 60837 on this machine is the instance's Service Broker endpoint (shown by sys.dm_tcp_listener_states), so the TCP connection opens and is then reset during the TDS pre-login.
sqlcmd -S tcp:127.0.0.1,60837 -E -C -l 5Sqlcmd: Error: Microsoft ODBC Driver 18 for SQL Server : Client unable to establish connection because an error was encountered during handshakes before login. Common causes include client attempting to connect to an unsupported version of SQL Server, server too busy to accept new connections or a resource limitation (memory or maximum allowed connections) on the server.. Sqlcmd: Error: Microsoft ODBC Driver 18 for SQL Server : TCP Provider: An existing connection was forcibly closed by the remote host. . Sqlcmd: Error: Microsoft ODBC Driver 18 for SQL Server : Client unable to establish connection. Sqlcmd: Error: Microsoft ODBC Driver 18 for SQL Server : Client unable to establish connection due to prelogin failure.
How to prevent it
Keep client drivers current and plan TLS hardening (disabling protocols or cipher suites) together with the database team, testing a connection from each application host before and after the change. Use certificates with SHA256 or better for SQL Server.
Document the T-SQL port of each instance and keep it separate from Service Broker, mirroring and availability group endpoints in firewall rules and connection strings.
Common questions
Is SQL Server error 10054 a database error?
The connection error is not: it is the Windows Sockets error WSAECONNRESET reported by the client driver. The engine message 10054 in sys.messages is an unrelated provider overflow message that shares the number.
Why did this start after Windows updates or a security change?
Disabling TLS 1.0 and 1.1 or removing cipher suites can leave an older client with nothing in common with the server, so the handshake is reset. Update the client driver rather than re-enabling old protocols.
What does "pre-login handshake" mean?
It is the first exchange between client and SQL Server, before any login is checked, where they agree on encryption. A reset there means the session never got as far as authentication, so there is no login failure in the error log.
Learn more on CodeWithSQL
Official documentation
- An existing connection was forcibly closed (OS error 10054) (Microsoft Learn)
- TLS 1.2 support for Microsoft SQL Server
- sys.dm_tcp_listener_states (Transact-SQL)
Last technically reviewed 23 October 2026; examples and diagnostics run on SQL Server 2025 (17.0.1145.4), ODBC Driver 18 for SQL Server. Message text checked against the engine's sys.messages catalogue.