Securing SQl Authentication

• K. Brian Kelley

  SSC Guru

  Points: 114704

  More actions

  February 19, 2009 at 8:16 am

  #946744

  There isn't anything you need to do. Starting with SQL Server 2005, SQL Server uses TLS to encrypt the logon packets. It'll use its own self-signed cert if necessary. So if you're just worried about the logon process, that's covered. If you're worried about all data, then yes, use SSL or IPSEC. More here:

  BOL: Encrypting Connections to SQL Server

  K. Brian Kelley
  @kbriankelley

• Chris Rowley

  Valued Member

  Points: 70

  More actions

  February 19, 2009 at 8:57 am

  #946812

  Thanks for the info..

  Just so that we're clear, are you saying that I don't even have to load a Cert for the traffic to be encrypted and the encryption happens automatically without any settings being changed at either the server or client?

  I can get hold of Server Authentication Certs without any trouble if required...

• K. Brian Kelley

  SSC Guru

  Points: 114704

  More actions

  February 19, 2009 at 9:58 am

  #946881

  Chris Rowley (2/19/2009)

  ---

  Thanks for the info..

  Just so that we're clear, are you saying that I don't even have to load a Cert for the traffic to be encrypted and the encryption happens automatically without any settings being changed at either the server or client?

  I can get hold of Server Authentication Certs without any trouble if required...

  It happens automatically, you don't have to do anything. If you had a 3rd party issued cert from a trusted CA, it would use that. But if that's not available, SQL Server 2005/8 will use its own self-signed cert.

  K. Brian Kelley
  @kbriankelley