Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I connect to some e-commerce website with my browser I use HTTPS that uses a certificate that (more or less) guarantees that is indeed

Now I connect to a SQL Server somewhere on the Internet - it might be SQL Azure for example and then I just connect to a URL like There's a chance that there's a fake server there and then I expose my sensitive data. I haven't found any evidence that certificates or anything equivalent is used when connecting to SQL Server.

How is SQL Server host identity ensured?

share|improve this question
up vote 5 down vote accepted

I'm not familiar with Azure but I can speak to SQL Server in general. SQL has a property called Force Encryption (which is set through SQL's Configuration Manager), which as it sounds will force clients to connect over encrypted sessions. This is done with certificates just like SSL. This guarantees the authenticity of the server as well as providing for encrypted communications.

It's a bit nuanced - you can use a certificate issued by a CA that the clients trust or SQL can use a self signed certificate (less secure). There's also client side settings you can set in the connection string that will influence the connection - depending on ODBC or OLEDB the pertinent properties are something like "Encrypt" and "TrustServerCertificate".

share|improve this answer
Is this article on this specific topic? – sharptooth Apr 9 '13 at 11:29
I'm not familiar with that link, but here's one and another – Henry Lee Apr 9 '13 at 13:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.