4

Is it possible if I wanted to set up SQL Server 2008 R2 instance so that it only accepts SSL Connection?

I am getting different answers and based on my testing, it will accept non-SSL connection even though I have force encryption as instructed on http://msdn.microsoft.com/en-us/library/ms191192%28v=sql.105%29.aspx

The last comment from Edward Dorland on this thread (SQL Server SSL connection - What am I missing?) pointed out "SQL server uses ssl for encryption, that doesnt need a cert at the client side."

Could anyone explain in detail?

Thanks.

  • How do you know it accepts a non-SSL connection? I would recommend first doing "SELECT * FROM sys.dm_exec_connections" and look for the encryption bit. If all connections are showing TRUE, then pull out your packet sniffer and take a look to get a second level of validation; in this particular case, the Microsoft products do a better job of decoding the encapsulated SSL traffic than Wireshark does. – Anti-weakpasswords Dec 29 '14 at 5:40
2

If you enable the force encryption option and restart the SQL Server instance then all connections between the instance and the SQL Server will be encrypted via SSL. There is no need for a certificate or change to the client. The server tells the driver that it needs to switch to an encrypted session. Thus is kind of like when you connect to a website using http:// and the Web server tells your browser to switch and reconnect using https://. It all happens without the user needing to do anything.

There's no need for an appliance to do this. SQL Server has been doing this internally just fine since SQL 2000.

What SQL does isn't to block unencrypted sessions, it converts unencrypted sessions to encrypted then allows them to continue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.