4

I'm trying to configure SQL Server 2017 Express Edition to use TLS 1.2 encryption, and accept connections from a simple test JDBC program. I'm reasonably experienced with java and MSSQL, but not so much with encryption. I'm following Microsoft's documentation as much as is humanly possible.

I have a very simple JDBC test program, and my SQL Server still has "Force Encryption" set to "No".

When I connect to the server using the simple URL:

jdbc:sqlserver://...\SQLEXPRESS:1433;databaseName=...;user=...;password=...

it fails with the dreaded:

sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

When I append ";encrypt=false" to the URL, it connects fine.

But when I take a Wireshark network trace of that successful transaction (with "encrypt=false"), I still see what looks like a TLSv1.2 handshake in the trace. The "Info" in Wireshark for those records are:

  1. "Client Hello"
  2. "Server Hello, Certificate, Server Key Exchange, Server Hello Done"
  3. "Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message"
  4. "Change Cipher Spec, Encrypted Handshake Message"
  5. "Application Data"

What are these? Since I've specified "encrypt=false" I expected to see no TLS in the trace.

Thanks.

Improve this question
0

1 Answer 1

Reset to default
5

Encrypt=false indicates the client does not require encryption. TLS will still used when possible, encrypting login credentials at a minimum. Below is the relevant excerpt from the jdbc documentation when Encrypt=false is specified.

The driver won't force the server to support TLS encryption. If the server has a self-signed certificate, the driver initiates the TLS certificate exchange. The TLS certificate won't be validated and only the credentials (in the login packet) are encrypted.

If the server requires the client to support TLS encryption, the driver will initiate the TLS certificate exchange. The TLS certificate won't be validated, but the entire communication will be encrypted.

Improve this answer
2
  • Thanks Dan. After the login, what happens with subsequent traffic? E.g., simple queries. Are they encrypted? In that network trace of my simple JDBC program and I can also see TDS packets that include my SQL in clear text as well as "Pre-Login Message -> Option: Encryption -> Encryption is available but off (0)", so I can confirm that encryption is not being used. But in a trace of my Tomcat web application I don't see any TLD packets, everything looks like it is encrypted. Could that be because the Tomcat web application uses Hibernate to access the database?
    – Larry Menard
    Commented Jan 25, 2023 at 14:36
  • Never mind my previous comment... I found the problem. Took a trace of the wrong server. The web application is now acting the same as the simple JDBC program... queries are not encrypted.
    – Larry Menard
    Commented Jan 25, 2023 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.