PureMessage and TLS 1.2 - I have followed the guides but cannot get it to work. Please help!

In regards to checking the db connection.. idk about any tools.. but do this and select the appropriate server address and pure-message user (you may need to reset the pw in ad if you dont remember the correct pw from install) 

Windows +r type cmd

Cd /users/name/desktop

Copy con test.udl (enter)

Ctrl + z

1 file copied

Double click on the file and select the server / user information and run the test

you may wish to try your install well running the SDU tool, this will output more verbose logs that support can help you with

https://community.sophos.com/kb/en-us/33533

worst case you could export the db, create a new one or just nuke it if you have a recent back up of configuration and dont care about spam. but you shouldn't need to to do that.

if all else fails, open a support case and send the SDU logs to the case, please do not post them on the forums.

The trouble is, I did delete the previous DB and then started from scratch.

I was able to successfully recreate the DB during the install procedure, but the install fails to complete as it cannot then connect to the instance. 

I am sure there is still something wrong with my configuration which is preventing connection over TLS1.2.

SQL Server 2012 version is 11.4.7001.0 (I believe that this is express SP4) -  I am struggling to clarify for 100% if this version if TLS 1.2 compatible.

I have SQL Server Native Client 10 (2009.100.6542.00) and SQL Server Native Client 11 (2011.110.7001.00) installed. 

you will need to collect those sdu logs and open a case.

there are some additional general things you can try .. but without the install log and sdu files it will not be possible to solve the case  (ie via the forms) 

#1 the hostnames of the server must be present in the certificate, as well they must be resolvable by the hosts .. ie : CN = mycomputer.mynet.local  and host can resolve mycomputer and mycomputer.mynet.local.

#2 you can verify the certificate thats been presented with something like this:

openssl s_client -connect mycomputer.mynet.local:5432 -showcerts </dev/null 2>/dev/null|openssl x509 -outform PEM >/tmp/mycertfile.pem

then view it with:

openssl x509 -in mycertfile.pem -noout -hash -issuer -subject -dates -fingerprint -text

(sorry I don't have windows equivalent)   the purpose of pulling down the cert is to make sure that the actual connection is actually presenting the correct certificate.   often other services get in the way and present their certs. or other weird stuff like that can happen

#3 depending on the error.. if your getting something like this.. a kb may help .. just search for "puremessage errorcode"  this is a sample of a 4005 unknown error.

https://community.sophos.com/kb/en-us/26084

NOTE: do NOT execute this kb unless the error is the same (can can verify the error in the SDU logs)

you will need to collect those sdu logs and open a case.

there are some additional general things you can try .. but without the install log and sdu files it will not be possible to solve the case  (ie via the forms) 

#1 the hostnames of the server must be present in the certificate, as well they must be resolvable by the hosts .. ie : CN = mycomputer.mynet.local  and host can resolve mycomputer and mycomputer.mynet.local.

#2 you can verify the certificate thats been presented with something like this:

openssl s_client -connect mycomputer.mynet.local:5432 -showcerts </dev/null 2>/dev/null|openssl x509 -outform PEM >/tmp/mycertfile.pem

then view it with:

openssl x509 -in mycertfile.pem -noout -hash -issuer -subject -dates -fingerprint -text

(sorry I don't have windows equivalent)   the purpose of pulling down the cert is to make sure that the actual connection is actually presenting the correct certificate.   often other services get in the way and present their certs. or other weird stuff like that can happen

#3 depending on the error.. if your getting something like this.. a kb may help .. just search for "puremessage errorcode"  this is a sample of a 4005 unknown error.

https://community.sophos.com/kb/en-us/26084

NOTE: do NOT execute this kb unless the error is the same (can can verify the error in the SDU logs)