WebException: SSL/TLS Error – The underlying connection was closed – REST API

[ZappySys]

Problem: Sometimes you may get following error when using HTTPS Url in REST API Task or JSON/XML Source.

Error: System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send.
Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.
An existing connection was forcibly closed by the remote host

or

The request was aborted: Could not create SSL/TLS secure channel.

Cause: Possible cause for this issue could be target server rejects your Web requests because SSL connection was not open due to invalid SSL protocol or unsupported SSL protocol version.

Solution-1:
Gotot Advanced Options tab for REST API Task or JSON/XML Source. Find option called [Security Protocol for HTTPS]. Change option to TLS 1.1 or higher.

This option may not be available for older version of SSIS PowerPack (older than 2.4.1.10411 [Downloaded before April 11, 2017]) or you have SSIS 2008 or 2012. If TLS 1.1 or Higher option not found in dropdown then download latest version to add support for TLS 1.1 and TLS 1.2 protocol.
Solution-2:
If you cannot use solution-1 for some reason then try to check Ignore SSL related Errors option on the Advanced Tab (REST API or JSON/XML Source) see this helps.

NOTE : SSIS PowerPack version 2.4.1.10411 and later now supports TLS 1.1 / 1.2 for SSIS 2012 and 2008 too. Download latest version and you will see additional option for TLS 1.1 and 1.2

Firewall / Network Restrictions

In some environments (especially after server migration or network changes), outbound HTTPS connections may be blocked by a firewall. This can cause errors such as:

System.Net.WebException: The underlying connection was closed
An unexpected error occurred on a send
Authentication failed because the remote party has closed the transport stream

In many cases this happens because the server cannot reach the required API or licensing endpoints due to firewall restrictions. Allowing outbound traffic to the required domains resolves the issue in such scenarios.

Minimum Network Requirements

• Protocol: HTTPS (TLS 1.2 or higher)
• Port: TCP 443 (Outbound)

Domains to Allow

Depending on your integration, ensure outbound access is allowed to:

• Target API domains (e.g., api.vendor.com, graph.microsoft.com)
• OAuth authentication endpoints (e.g., login.microsoftonline.com, accounts.google.com)
• ZappySys licensing endpoint: https://zappysys.com (used for license activation and validation)

Common Enterprise Firewalls

Your IT team may need to allow these connections in firewall systems such as:

• Azure Firewall (Microsoft Azure)
• AWS Security Groups
• Palo Alto Networks Firewall

If the connection works when all outbound traffic is temporarily allowed, but fails when firewall rules are enforced, this confirms the issue is related to firewall restrictions.

[Author]

Posts