4

Is it possible if I wanted to set up SQL Server 2008 R2 instance so that it only accepts SSL Connection?

I am getting different answers and based on my testing, it will accept non-SSL connection even though I have force encryption as instructed on http://msdn.microsoft.com/en-us/library/ms191192%28v=sql.105%29.aspx

The last comment from Edward Dorland on this thread (SQL Server SSL connection - What am I missing?) pointed out "SQL server uses ssl for encryption, that doesnt need a cert at the client side."

Could anyone explain in detail?

Thanks.

Improve this question
1
  • How do you know it accepts a non-SSL connection? I would recommend first doing "SELECT * FROM sys.dm_exec_connections" and look for the encryption bit. If all connections are showing TRUE, then pull out your packet sniffer and take a look to get a second level of validation; in this particular case, the Microsoft products do a better job of decoding the encapsulated SSL traffic than Wireshark does. Commented Dec 29, 2014 at 5:40

1 Answer 1

Reset to default
2

If you enable the force encryption option and restart the SQL Server instance then all connections between the instance and the SQL Server will be encrypted via SSL. There is no need for a certificate or change to the client. The server tells the driver that it needs to switch to an encrypted session. Thus is kind of like when you connect to a website using http:// and the Web server tells your browser to switch and reconnect using https://. It all happens without the user needing to do anything.

There's no need for an appliance to do this. SQL Server has been doing this internally just fine since SQL 2000.

What SQL does isn't to block unencrypted sessions, it converts unencrypted sessions to encrypted then allows them to continue.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.