Go 1.25 "TLS Handshake failed: cannot read handshake packet: EOF"

[jhw0604]

Describe the bug
Golang 1.25, the message TLS Handshake failed: cannot read handshake packet: EOF appears.

To Reproduce
Golang 1.24 and earlier work fine
but starting with 1.25, the message TLS Handshake failed: cannot read handshake packet: EOF appears.
If you set the environment variable GODEBUG=tlssha1=1 or add encrypt=disable to the connection string, Go will work properly.

Additional context
You can find the related text "SHA-1 signature algorithms are now disallowed in TLS 1.2 handshakes, per RFC 9155"

[shueybubbles]

@jhw0604 I guess if you can't get your SQL Server to use a new certificate with a stronger algorithm, the workaround with the env var is the only option. Am I missing something?

[jhw0604]

@shueybubbles Even if there are security concerns, it's practically impossible to enforce certificates on databases currently operating in a production environment.
Therefore, to support older databases that use SHA-1, it seems necessary to bring in the older version of the crypto/tls package into the driver.

How about using github.com/refraction-networking/utls only when communicating over legacy interfaces?