18

In SQL Server I can "Force Encryption" in protocols settings. If I leave that set to "No" any client can still require encryption.

Can I somehow see what connections to the database are using encryption?

Improve this question

4 Answers 4

Reset to default
24

From TechNet sys.dm_exec_connections DMV: the encrypt_option will display FALSE if the connection is not encrypted.

Here is an example TSQL statement that can be run by administrators (VIEW SERVER STATE is the required privilege):

SELECT session_id, connect_time, net_transport, encrypt_option, auth_scheme, client_net_address 
FROM sys.dm_exec_connections
Improve this answer
4
  • By default, this does not work for non-sysadmins. Accessing the dm_exec_connections view requires VIEW SERVER STATE permission on the server, which is not granted by default. Do you know of an alternative, which by default, all logins can access ?
    – William
    Jan 25, 2017 at 16:01
  • 2
    why would a non 'VIEW SERVER STATE' user have any business checking whether connections are encrypted?
    – Mitch Wheat
    Oct 1, 2018 at 16:42
  • 1
    @MitchWheat The same reason you, a 'standard user', can see the 🔒 padlock icon up top in your browser right now - to know that their connection is encrypted. Users must not need administrator privileges to ensure encryption is being used. tldr: for security
    – Ian Boyd
    Apr 4, 2021 at 23:58
  • If a standard user (I would say a client application) want a encrypted connection. It has to use/check the dedicated key (Encrypt=True) in the connexion string !
    – Marco Guignard
    May 19, 2021 at 10:08
5

There are various methods to check the connections :

  1. You can use a third party tool like Wireshark which lets you see what's happening on your network at a microscopic level and will help you in getting those encrypted connections.

  2. You can also use the Microsoft Network Monitor 3.4 to get those connection details.

  3. And as mentioned by travis you can also look at encrypt_option column of the sys.dm_exec_connections DMV

In addition please read the article which will help you understand more on this Encrypting connections in SQL Server 2005 & SQL Native Client with SS

Improve this answer
3

Please note that in SQL Server Management Studio (SSMS) the "View connection properties" does not show if the connection is Encrypted. It only shown if the client (SSMS) has asked for the connection to be encrypted.

enter image description here

If you are using Force Encryption = true on the server configuration all connections will be encrypted, but SSMS will not indicate it.

You can validate the connection on the server with:

SELECT encrypt_option,* FROM sys.dm_exec_connections

encrypt_option will be true for encrypted connections

enter image description here

Improve this answer
4
  • 1
    This answer doesn't seem to add any new information to the earlier accepted answer.
    – mustaccio
    Jan 7, 2021 at 14:27
  • 1
    It add the very often reason for why people ask this question, "SSMS connection properties does not show if the connection is Encrypted"
    – Henrik Høyer
    Jan 9, 2021 at 12:59
  • 1
    @mustaccio StackExchange is a combination of Reddit and Wikipedia. As such, more relevant information is always welcome.
    – Ian Boyd
    Apr 5, 2021 at 0:05
  • 1
    Thanks, this helped with some head scratching on my end.
    – csrowell
    May 10, 2021 at 18:32
2

You can also check whether the connection in encrypted in the SSMS, when you connect to a server with encryption, you will see a lock icon next to the server name in the bottom panel: encrypted connection SSMS

Without encryption, there is only server name without lock icon.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.