I'm trying to configure SQL Server 2017 Express Edition to use TLS 1.2 encryption, and accept connections from a simple test JDBC program. I'm reasonably experienced with java and MSSQL, but not so much with encryption. I'm following Microsoft's documentation as much as is humanly possible.
I have a very simple JDBC test program, and my SQL Server still has "Force Encryption" set to "No".
When I connect to the server using the simple URL:
it fails with the dreaded:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
When I append ";encrypt=false" to the URL, it connects fine.
But when I take a Wireshark network trace of that successful transaction (with "encrypt=false"), I still see what looks like a TLSv1.2 handshake in the trace. The "Info" in Wireshark for those records are:
- "Client Hello"
- "Server Hello, Certificate, Server Key Exchange, Server Hello Done"
- "Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message"
- "Change Cipher Spec, Encrypted Handshake Message"
- "Application Data"
What are these? Since I've specified "encrypt=false" I expected to see no TLS in the trace.