I'm having trouble finding any documentations regarding supported key lengths for RSA certs to encrypt SQL connections. Our internal CA is issuing certs with a 4096 key length and that seems to work with our 2019 SQL servers, but I cannot seem to get anything lower than 2019 to see the certs in Configuration Manager. My hunch is that 2017 and below do not support a 4096 key length but I'm not able to find any documentation saying what is actually supported so it's only a guess right now. Does anybody have any documentation showing what is supported by each version? Thanks.
2
-
RSA_4096, RSA_3072, RSA_2048 should work for 2016 and above. As per this document.– SqlWorldWideSep 24, 2021 at 19:46
-
1I'm pretty sure that only is in reference to things like TDE. The cert I am referring to is for connection encryption. It's not created with SQL it is created with our cert authority.– Davin StuderSep 24, 2021 at 20:37
Add a comment
|
1 Answer
It looks like maybe the issue was not an issue with the key length but rather the type of cert. The below link has this and it looks like when we created a new cert template to use the legacy CSP it worked. So, it looks like maybe SQL 2019 supports KSP, but 2017 and below only support CSP.
After releasing Windows Vista and Windows Server 2008, there is a brand new CSP subsystem called Cryptography Next Generation (CNG). CNG is was written from scratch and is not compatible with legacy CSP subsystem. CNG brings a lot of improvements to CryptoAPI, but the idea is still the same. Also, CNG ships a new class of CSPs called Key Storage Provider or KSP. In general, KSP and CSP are similar in terms of their purpose. CSP refers to legacy CryptoAPI 1.0 and KSP refers to CNG or CAPI2.