12

In SQL Server I can "Force Encryption" in protocols settings. If I leave that set to "No" any client can still require encryption.

Can I somehow see what connections to the database are using encryption?

17

From TechNet sys.dm_exec_connections DMV: the encrypt_option will display FALSE if the connection is not encrypted.

Here is an example TSQL statement that can be run by administrators (VIEW SERVER STATE is the required privilege):

SELECT session_id, connect_time, net_transport, encrypt_option, auth_scheme, client_net_address 
FROM sys.dm_exec_connections
4
  • By default, this does not work for non-sysadmins. Accessing the dm_exec_connections view requires VIEW SERVER STATE permission on the server, which is not granted by default. Do you know of an alternative, which by default, all logins can access ?
    – William
    Jan 25 '17 at 16:01
  • 2
    why would a non 'VIEW SERVER STATE' user have any business checking whether connections are encrypted? Oct 1 '18 at 16:42
  • @MitchWheat The same reason you, a 'standard user', can see the 🔒 padlock icon up top in your browser right now - to know that their connection is encrypted. Users must not need administrator privileges to ensure encryption is being used. tldr: for security
    – Ian Boyd
    Apr 4 at 23:58
  • If a standard user (I would say a client application) want a encrypted connection. It has to use/check the dedicated key (Encrypt=True) in the connexion string ! May 19 at 10:08
4

There are various methods to check the connections :

  1. You can use a third party tool like Wireshark which lets you see what's happening on your network at a microscopic level and will help you in getting those encrypted connections.

  2. You can also use the Microsoft Network Monitor 3.4 to get those connection details.

  3. And as mentioned by travis you can also look at encrypt_option column of the sys.dm_exec_connections DMV

In addition please read the article which will help you understand more on this Encrypting connections in SQL Server 2005 & SQL Native Client with SS

2

Please note that in SQL Server Management Studio (SSMS) the "View connection properties" does not show if the connection is Encrypted. It only shown if the client (SSMS) has asked for the connection to be encrypted.

enter image description here

If you are using Force Encryption = true on the server configuration all connections will be encrypted, but SSMS will not indicate it.

You can validate the connection on the server with:

SELECT encrypt_option,* FROM sys.dm_exec_connections

encrypt_option will be true for encrypted connections

enter image description here

4
  • 1
    This answer doesn't seem to add any new information to the earlier accepted answer.
    – mustaccio
    Jan 7 at 14:27
  • 1
    It add the very often reason for why people ask this question, "SSMS connection properties does not show if the connection is Encrypted" Jan 9 at 12:59
  • 1
    @mustaccio StackExchange is a combination of Reddit and Wikipedia. As such, more relevant information is always welcome.
    – Ian Boyd
    Apr 5 at 0:05
  • 1
    Thanks, this helped with some head scratching on my end.
    – csrowell
    May 10 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.