0

I know there are plenty of posts here regarding SQL Server and SSL encrypted connections, however I didn't find any that touched on this particular subject. In this article, it mentions that performance is hindered with enabled SSL connections due to the extra processing required. In a shared database server, where database-A will have encrypted connection, but database-B will not, will database-B's performance be affected somehow due to the encrypted connections being processed on database-A?

4
  • 1
    The link is invalid; it's pointing to the Stack Exchange Area 51 site. – Hannah Vernon Mar 23 '17 at 19:25
  • SSL happens on the connections, there is an extra set of handshakes... it doesn't change how SQL Server runs a query. – Sean Gallardy - Retired User Mar 23 '17 at 22:59
  • Fixed the article I meant to link. @SeanGallardy, there is some extra processing for decrypting/encrypting the packets sent between server and client, aside from the extra set of hand shakes: - An extra network roundtrip is required at connect time. - Packets sent from the application to the instance of SQL Server must be encrypted by the client Net-Library and decrypted by the server Net-Library. - Packets sent from the instance of SQL Server to the application must be encrypted by the server Net-Library and decrypted by the client Net-Library. – Guillermo Garcia Mar 26 '17 at 14:46
  • It still doesn't change how the query is run which is the part that will be taking the most amount of time... save for a select * from blobtable in which case, SSL is the least of your performance issues. – Sean Gallardy - Retired User Mar 26 '17 at 23:10
0

The connection encryption happens at the SQL Server instance level, not at the level of individual databases.

You can have encryption turned on at the instance, in which case every connection to it will be encrypted, or you can set a client to require encryption. Keep in mind every instance such a client connects to will have to have a certificate which the client trusts. Some light reading: https://support.microsoft.com/en-us/help/316898/how-to-enable-ssl-encryption-for-an-instance-of-sql-server-by-using-microsoft-management-console

So to answer your question directly, yes, if one client connects to an instance with encryption and others don't, that one client will require more processing power than the others. Having said that, unless there's a configuration problem or the server is having processing capacity issues, nobody should notice.

3
  • Is that so? I thought that with ForceEncryption set to No, only applications that "requested" an encrypted connection to the instance would be encrypted. From what you're saying, if I set up an instance to accept SSL encrypted connections, and only 1 out of 5 apps that connect to the instance requests the encrypted connection, the other 4 apps would not be able to connect unencrypted (the default)? – Guillermo Garcia Mar 26 '17 at 14:55
  • @GuillermoGarcia I updated my answer to reflect clients requesting encryption. – S M Mar 26 '17 at 17:07
  • @S M Thanks for the clarification. I was talking to a colleague about it and we got to the same conclusion. There is some extra CPU involved but like you said, in a well provisioned system, nobody should notice. – Guillermo Garcia Mar 26 '17 at 22:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.