Force protocol encryption.

Hi ,
What do I have to do to make this option valid between
Sql Server and clients ?
I tried to mark the needed check boxes in the client network utility and in
the server network utility but it didn`t work
regards ,
DBA.Set the Force Protocol Encryption option to ON on the server by using the SQ
L Server Server Network Utility. If you turn on encryption on the server, al
l the clients must connect by using encryption and you must install a certif
icate on the server. For mo
re information, refer to the "Net-Library Encryption" topic in SQL Server 20
00 Books Online.
KBA http://support.microsoft.com/defaul...kb;EN-US;318605 for the r
eference.
BTW what was the error when you set the encryption?
--
Satya SKJ
Visit http://www.sql-server-performance.com for tips and articles on Perform
ance topic.
"w2system@.system.com" wrote:

> Hi ,
> What do I have to do to make this option valid between
> Sql Server and clients ?
> I tried to mark the needed check boxes in the client network utility and i
n
> the server network utility but it didn`t work
> regards ,
> DBA.
>
>sql

force protocol encryption on the server network utility registry setting

Does anyone know when the registry key is to unset the "force protocol
encryption" on the server network utiltiy is?
Thanks
Seems to be (for a default instance):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\ MSSQLServer\SuperSocketNetLib
Key name "Encrypt" (REG_DWORD). Value 1 seems to be enforced. 1 means not enforced. Reg key didn't
exist until I enforced encryption.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Joel" <nowhere@.nowhere.com> wrote in message news:uEWoaqR7FHA.3864@.TK2MSFTNGP10.phx.gbl...
> Does anyone know when the registry key is to unset the "force protocol encryption" on the server
> network utiltiy is?
> Thanks
>
|||Thanks
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:uWInJ7R7FHA.3684@.TK2MSFTNGP12.phx.gbl...
> Seems to be (for a default instance):
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\ MSSQLServer\SuperSocketNetLib
> Key name "Encrypt" (REG_DWORD). Value 1 seems to be enforced. 1 means not
> enforced. Reg key didn't exist until I enforced encryption.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "Joel" <nowhere@.nowhere.com> wrote in message
> news:uEWoaqR7FHA.3864@.TK2MSFTNGP10.phx.gbl...
>

force protocol encryption on the server network utility registry setting

Does anyone know when the registry key is to unset the "force protocol
encryption" on the server network utiltiy is?
ThanksSeems to be (for a default instance):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS
SQLServer\MSSQLServer\SuperSocketNet
Lib
Key name "Encrypt" (REG_DWORD). Value 1 seems to be enforced. 1 means not en
forced. Reg key didn't
exist until I enforced encryption.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Joel" <nowhere@.nowhere.com> wrote in message news:uEWoaqR7FHA.3864@.TK2MSFTNGP10.phx.gbl...[
vbcol=seagreen]
> Does anyone know when the registry key is to unset the "force protocol enc
ryption" on the server
> network utiltiy is?
> Thanks
>[/vbcol]|||Thanks
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:uWInJ7R7FHA.3684@.TK2MSFTNGP12.phx.gbl...
> Seems to be (for a default instance):
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS
SQLServer\MSSQLServer\SuperSocketN
etLib
> Key name "Encrypt" (REG_DWORD). Value 1 seems to be enforced. 1 means not
> enforced. Reg key didn't exist until I enforced encryption.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "Joel" <nowhere@.nowhere.com> wrote in message
> news:uEWoaqR7FHA.3864@.TK2MSFTNGP10.phx.gbl...
>

force protocol encryption on the server network utility registry setting

Does anyone know when the registry key is to unset the "force protocol
encryption" on the server network utiltiy is?
ThanksSeems to be (for a default instance):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib
Key name "Encrypt" (REG_DWORD). Value 1 seems to be enforced. 1 means not enforced. Reg key didn't
exist until I enforced encryption.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Joel" <nowhere@.nowhere.com> wrote in message news:uEWoaqR7FHA.3864@.TK2MSFTNGP10.phx.gbl...
> Does anyone know when the registry key is to unset the "force protocol encryption" on the server
> network utiltiy is?
> Thanks
>|||Thanks
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:uWInJ7R7FHA.3684@.TK2MSFTNGP12.phx.gbl...
> Seems to be (for a default instance):
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib
> Key name "Encrypt" (REG_DWORD). Value 1 seems to be enforced. 1 means not
> enforced. Reg key didn't exist until I enforced encryption.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "Joel" <nowhere@.nowhere.com> wrote in message
> news:uEWoaqR7FHA.3864@.TK2MSFTNGP10.phx.gbl...
>> Does anyone know when the registry key is to unset the "force protocol
>> encryption" on the server network utiltiy is?
>> Thanks
>

Force Protocol Encryption Enabled & SQL Server Cannot Start

I'm running SQL 2000 Server with Windows service account with a normal user
privileges.
However, whenever I turn on Force Protocol Encryption (the cert is already
installed), the server does not start.
I suspect that it's to do with the service account which does not have
rights to the cert. How do I grant the service account with sufficient
privilege to read the cert so that Force Protocol Encryption can be enabled?
Thanks.How SQL Server uses a certificate when the Force Protocol Encryption option
is set on http://support.microsoft.com/default.aspx?scid=kb;en-us;318605
How SQL Server verifies that a certificate is valid
â?¢ The certificate's Enhanced Key Usage property has to be turned on for
Server Authentication. To verify that the certificate is used for server
authentication, use the Microsoft Management Console (MMC) Certificate
snap-in. Double-click the certificate name, and then select Details. Click
the Enhanced Key Usage property, and then verify that the value is: Server
Authentication(1.3.6.1.5.5.7.3.1).
â?¢ Make sure that the certificate name is the same as the SQL Server FQDN or
the value configured in the registry (as described earlier).
â?¢ You must install the certificate to the Certificates\Current User Personal
Certificates folder while you are logged on as the SQL Server startup
account. This will make sure that the certificate will be put in the Personal
Certificates folder of the SQL Server startup account. If you have logged on
with a user account that is different from the SQL Server startup account,
put the certificate in the Certificates\Local Computer Personal Certificates
folder. This action solves the problem of having certificates stored under
the wrong user account.
To view the Current User folder, follow these steps:1. Logon as the SQL
Server startup account.
2. Use the MMC Certificates snap-in to verify the location of the
certificate.
FIX: Cannot Use Non-Administrator Account to Start SQL Server and Force
Encryption http://support.microsoft.com/default.aspx?scid=kb;en-us;314636
"James" wrote:
> I'm running SQL 2000 Server with Windows service account with a normal user
> privileges.
> However, whenever I turn on Force Protocol Encryption (the cert is already
> installed), the server does not start.
> I suspect that it's to do with the service account which does not have
> rights to the cert. How do I grant the service account with sufficient
> privilege to read the cert so that Force Protocol Encryption can be enabled?
> Thanks.

Force Protocol Encryption Enabled & SQL Server Cannot Start

I'm running SQL 2000 Server with Windows service account with a normal user
privileges.
However, whenever I turn on Force Protocol Encryption (the cert is already
installed), the server does not start.
I suspect that it's to do with the service account which does not have
rights to the cert. How do I grant the service account with sufficient
privilege to read the cert so that Force Protocol Encryption can be enabled?
Thanks.
How SQL Server uses a certificate when the Force Protocol Encryption option
is set on http://support.microsoft.com/default...b;en-us;318605
How SQL Server verifies that a certificate is valid
? The certificate's Enhanced Key Usage property has to be turned on for
Server Authentication. To verify that the certificate is used for server
authentication, use the Microsoft Management Console (MMC) Certificate
snap-in. Double-click the certificate name, and then select Details. Click
the Enhanced Key Usage property, and then verify that the value is: Server
Authentication(1.3.6.1.5.5.7.3.1).
? Make sure that the certificate name is the same as the SQL Server FQDN or
the value configured in the registry (as described earlier).
? You must install the certificate to the Certificates\Current User Personal
Certificates folder while you are logged on as the SQL Server startup
account. This will make sure that the certificate will be put in the Personal
Certificates folder of the SQL Server startup account. If you have logged on
with a user account that is different from the SQL Server startup account,
put the certificate in the Certificates\Local Computer Personal Certificates
folder. This action solves the problem of having certificates stored under
the wrong user account.
To view the Current User folder, follow these steps:1. Logon as the SQL
Server startup account.
2. Use the MMC Certificates snap-in to verify the location of the
certificate.
FIX: Cannot Use Non-Administrator Account to Start SQL Server and Force
Encryption http://support.microsoft.com/default...b;en-us;314636
"James" wrote:

> I'm running SQL 2000 Server with Windows service account with a normal user
> privileges.
> However, whenever I turn on Force Protocol Encryption (the cert is already
> installed), the server does not start.
> I suspect that it's to do with the service account which does not have
> rights to the cert. How do I grant the service account with sufficient
> privilege to read the cert so that Force Protocol Encryption can be enabled?
> Thanks.

Force Protocol Encryption Enabled & SQL Server Cannot Start

I'm running SQL 2000 Server with Windows service account with a normal user
privileges.
However, whenever I turn on Force Protocol Encryption (the cert is already
installed), the server does not start.
I suspect that it's to do with the service account which does not have
rights to the cert. How do I grant the service account with sufficient
privilege to read the cert so that Force Protocol Encryption can be enabled?
Thanks.How SQL Server uses a certificate when the Force Protocol Encryption option
is set on http://support.microsoft.com/defaul...kb;en-us;318605
How SQL Server verifies that a certificate is valid
? The certificate's Enhanced Key Usage property has to be turned on for
Server Authentication. To verify that the certificate is used for server
authentication, use the Microsoft Management Console (MMC) Certificate
snap-in. Double-click the certificate name, and then select Details. Click
the Enhanced Key Usage property, and then verify that the value is: Serve
r
Authentication(1.3.6.1.5.5.7.3.1).
? Make sure that the certificate name is the same as the SQL Server FQDN o
r
the value configured in the registry (as described earlier).
? You must install the certificate to the Certificates\Current User Person
al
Certificates folder while you are logged on as the SQL Server startup
account. This will make sure that the certificate will be put in the Persona
l
Certificates folder of the SQL Server startup account. If you have logged on
with a user account that is different from the SQL Server startup account,
put the certificate in the Certificates\Local Computer Personal Certificates
folder. This action solves the problem of having certificates stored under
the wrong user account.
To view the Current User folder, follow these steps:1. Logon as the SQL
Server startup account.
2. Use the MMC Certificates snap-in to verify the location of the
certificate.
FIX: Cannot Use Non-Administrator Account to Start SQL Server and Force
Encryption http://support.microsoft.com/defaul...kb;en-us;314636
"James" wrote:

> I'm running SQL 2000 Server with Windows service account with a normal use
r
> privileges.
> However, whenever I turn on Force Protocol Encryption (the cert is already
> installed), the server does not start.
> I suspect that it's to do with the service account which does not have
> rights to the cert. How do I grant the service account with sufficient
> privilege to read the cert so that Force Protocol Encryption can be enable
d?
> Thanks.

Force protocol encryption

I am connection to a SQL server that has force protocol encryption checked. From my ASP.net application, specifically in my connection string, what parameter do I need to use to take advantage of this encryption?

Thanks!If using OLEDB, add this to the connection string:

Use Encryption for Data=True

force protocal encryption ?

Hi,
I could like to understand the SSL "force protocal encryption" on SQL 2000,
if I do this:
1: how much extra resource it will take to do encryption?
2: What certificate should we use, must we use certicate from public certifi
cation authority?
3: how will the client side affected after I turn on force protocal encrypti
on? should it be transparent to them if we install public certificate on the
server?
4: Can client still connect to server using IP address, or must FQDN is requ
ired?
Thanks
FrankHi Frank,
I'll try to address each concern:
1: how much extra resource it will take to do encryption?
-- there is some additional handshakes done to check the certificate during
the initial connection request.
You can see this via network trace. You could also use the SQL client
"Show CLient Statistics" to measure performance with and
without SSL in your environment.
2: What certificate should we use, must we use certicate from public
certification authority?
- The certificate is a Server cert issued to the FQDN of the server. It
has the same requirements a IIS server cert uses.
The subject name == FQDN and not the IP address of the server.
3: how will the client side affected after I turn on force protocal
encryption? should it be transparent to them if we install public
certificate on the server?
-- If you enable it on the Serverside, there is nothing needed on the
client.
4: Can client still connect to server using IP address, or must FQDN is
required?
-- No. You'll need to pass the netbios name or FQDN in the connection
string.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||Hi Kevin,
Thanks for your reply.
For question 2, what i read seems to be confusing(
http://support.microsoft.com/defaul...kb;en-us;318605), it says A
certificate is required because SSL encryption works only with instances of
SQL Server 2000 that are running on a computer that has a certificate
assigned from a public certification authority.
However, you seem to say we can also use server certificate assigned from
our own CA.
Thanks,
Frank
"Kevin McDonnell [MSFT]" <kevmc@.online.microsoft.com> wrote in message
news:iIaaeRNBFHA.1680@.cpmsftngxa10.phx.gbl...
> Hi Frank,
> I'll try to address each concern:
> 1: how much extra resource it will take to do encryption?
> -- there is some additional handshakes done to check the certificate
during
> the initial connection request.
> You can see this via network trace. You could also use the SQL client
> "Show CLient Statistics" to measure performance with and
> without SSL in your environment.
> 2: What certificate should we use, must we use certicate from public
> certification authority?
> - The certificate is a Server cert issued to the FQDN of the server. It
> has the same requirements a IIS server cert uses.
> The subject name == FQDN and not the IP address of the server.
> 3: how will the client side affected after I turn on force protocal
> encryption? should it be transparent to them if we install public
> certificate on the server?
> -- If you enable it on the Serverside, there is nothing needed on the
> client.
> 4: Can client still connect to server using IP address, or must FQDN is
> required?
> -- No. You'll need to pass the netbios name or FQDN in the connection
> string.
>
> Thanks,
> Kevin McDonnell
> Microsoft Corporation
> This posting is provided AS IS with no warranties, and confers no rights.
>
>|||Hi Frank,
You can use a Server certificate from you own internal CA or a Public CA.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.sql

force protocal encryption

This is a multi-part message in MIME format.
--=_NextPart_000_008F_01C503E2.52829930
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi,
I could like to understand the SSL "force protocal encryption" on SQL = 2000, if I do this:
1: how much extra resource it will take to do encryption?
2: What certificate should we use, must we use certicate from public = certification authority?
3: how will the client side affected after I turn on force protocal = encryption? should it be transparent to them if we install public = certificate on the server?
4: Can client still connect to server using IP address, or must FQDN is = required?
Thanks
Frank
--=_NextPart_000_008F_01C503E2.52829930
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
&
Hi,

I could like to understand the SSL = "force protocal encryption" on SQL 2000, if I do this:

1: how much extra resource it will take = to do encryption?
2: What certificate should we use, must = we use certicate from public certification authority?
3: how will the client side affected = after I turn on force protocal encryption? should it be transparent to them if we install public certificate on the server?
4: Can client still connect to server = using IP address, or must FQDN is required?

Thanks
Frank


--=_NextPart_000_008F_01C503E2.52829930--This is a multi-part message in MIME format.
--=_NextPart_000_009E_01C503EA.A15351F0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
I follow the MS link below and trying to Request New Certificate for SSL =using MMC, however, I cannot see "Request New Certificate" from the MMC =(under How to Configure the MMC Snap-in-->2-->b)
Is there other way to request a verisign certificate except from =certificate server?
Thanks
Frank
How to enable SSL encryption for SQL Server 2000 with Microsoft =Management Console
http://support.microsoft.com/kb/316898/EN-US/
"Frank" <signup0702@.sina.com> wrote in message =news:eEbJe85AFHA.1400@.TK2MSFTNGP11.phx.gbl...
Hi,
I could like to understand the SSL "force protocal encryption" on SQL =2000, if I do this:
1: how much extra resource it will take to do encryption?
2: What certificate should we use, must we use certicate from public =certification authority?
3: how will the client side affected after I turn on force protocal =encryption? should it be transparent to them if we install public =certificate on the server?
4: Can client still connect to server using IP address, or must FQDN =is required?
Thanks
Frank
--=_NextPart_000_009E_01C503EA.A15351F0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
&

---

I follow the MS link below and trying to Request New Certificate =for SSL using MMC, however, I cannot see "Request New Certificate" from the MMC =(under How to Configure the MMC Snap-in-->2-->b)
Is there other way to request a =verisign certificate except from certificate server?
Thanks
Frank
How to enable SSL encryption for SQL Server 2000 =with Microsoft Management Console
http://support.microsoft.com/kb/316898/EN-US/">http://support.mic=rosoft.com/kb/316898/EN-US/
"Frank" wrote =in message news:eEbJe85AFHA.1400=@.TK2MSFTNGP11.phx.gbl...
Hi,

I could like to understand the SSL ="force protocal encryption" on SQL 2000, if I do this:

1: how much extra resource it will =take to do encryption?
2: What certificate should we use, =must we use certicate from public certification authority?
3: how will the client side affected =after I turn on force protocal encryption? should it be transparent to them if we install public certificate on the server?
4: Can client still connect to server =using IP address, or must FQDN is required?

Thanks
Frank

---

--=_NextPart_000_009E_01C503EA.A15351F0--

force protocal encryption

Hi,
I could like to understand the SSL "force protocal encryption" on SQL 2000, if I do this:
1: how much extra resource it will take to do encryption?
2: What certificate should we use, must we use certicate from public certification authority?
3: how will the client side affected after I turn on force protocal encryption? should it be transparent to them if we install public certificate on the server?
4: Can client still connect to server using IP address, or must FQDN is required?
Thanks
Frank
I follow the MS link below and trying to Request New Certificate for SSL using MMC, however, I cannot see "Request New Certificate" from the MMC (under How to Configure the MMC Snap-in-->2-->b)
Is there other way to request a verisign certificate except from certificate server?
Thanks
Frank
How to enable SSL encryption for SQL Server 2000 with Microsoft Management Console
http://support.microsoft.com/kb/316898/EN-US/
"Frank" <signup0702@.sina.com> wrote in message news:eEbJe85AFHA.1400@.TK2MSFTNGP11.phx.gbl...
Hi,
I could like to understand the SSL "force protocal encryption" on SQL 2000, if I do this:
1: how much extra resource it will take to do encryption?
2: What certificate should we use, must we use certicate from public certification authority?
3: how will the client side affected after I turn on force protocal encryption? should it be transparent to them if we install public certificate on the server?
4: Can client still connect to server using IP address, or must FQDN is required?
Thanks
Frank

force protocal encryption

Hi,
I could like to understand the SSL "force protocal encryption" on SQL 2000,
if I do this:
1: how much extra resource it will take to do encryption?
2: What certificate should we use, must we use certicate from public certifi
cation authority?
3: how will the client side affected after I turn on force protocal encrypti
on? should it be transparent to them if we install public certificate on the
server?
4: Can client still connect to server using IP address, or must FQDN is requ
ired?
Thanks
FrankI follow the MS link below and trying to Request New Certificate for SSL usi
ng MMC, however, I cannot see "Request New Certificate" from the MMC (under
How to Configure the MMC Snap-in-->2-->b)
Is there other way to request a verisign certificate except from certificate
server?
Thanks
Frank
How to enable SSL encryption for SQL Server 2000 with Microsoft Management C
onsole
http://support.microsoft.com/kb/316898/EN-US/
"Frank" <signup0702@.sina.com> wrote in message news:eEbJe85AFHA.1400@.TK2MSFT
NGP11.phx.gbl...
Hi,
I could like to understand the SSL "force protocal encryption" on SQL 2000,
if I do this:
1: how much extra resource it will take to do encryption?
2: What certificate should we use, must we use certicate from public certifi
cation authority?
3: how will the client side affected after I turn on force protocal encrypti
on? should it be transparent to them if we install public certificate on the
server?
4: Can client still connect to server using IP address, or must FQDN is requ
ired?
Thanks
Frank

Force encryption on server not working?

Hi,

I am at a loss here, unless I misunderstand the whole point about server encryption. My 2005 SQL server has a certificate from a trust CA, I have turned on the 'force encryption' flags on the server. My understanding is any client will be "force" to connect with encryption? I found out that unless I turn on encryption on my clients, the server will allow connections without the requiring encryption. Am I missing something here? Thanks for any help you can provide.

Hi anhtuan,

Your understanding is correct. If you force encryption on the server, then all connections from clients will be encrypted; if the client doesn't support encryption (e.g., very old MDAC clients), then the server will reject the connection. Basic question -- I assume that you restarted the server after setting the FORCE ENCRYPTION setting?

Il-Sung.

Force Encryption on client with Thawte certificate

Hello
I think that I have read every paper on the Internet about SSL and SQL
2000 and have "pains takingly" tried to implement every suggestion.
1. I have a certificate from Thawte installed on a Windows 2000 server
that also has SQL 2000 installed.
2. The name of the certificate is a FQDN.
3. I can set Force Encryption on the Server side, restart the SQL
Server and it starts normally.
4. I use network monitor and can see network traffic encrypted between
client and server.
5. When I turn off Force Encryption with the "server utility", I
restart the SQL Server.
6. I turn on Force Encrytion on the client side.
7. I try to connect to the server with SQL Query and get an SSL Error.
8. There is only one certificate on the server.
9. I set the "friendly name" on the certificate to the FQDN.
10. I have viewed the certificate and I see no errors and the path
looks good.
11. I think that I have all the SPs installed.
I am assuming that the certificate is installed correctly because when
I set Force Encryption on the server, SQL Server starts with no
problem.
When I reset Force Encryption with the "server utility" -- restart the
SQL Server -- and set Force Encryption with the "client utility", I get
the "SSL error" when I try to log in with Query analyzer.
Because the SQL Instance and the client application are on the same
machine, and because I can see the Thawte Server CA under the Authority
tab, that the client trusts Thawte. Out of desperation, I even tried to
do an export and import using IE -- though I did not think that was
necessary because both client and server are on the same mchine.
This should not be this difficult
Any help is greatly appreciated.
Thanks
Hi
I can't say I have tried this but BOL states (second sentence):
"SSL encryption works only with instances of SQL Server 2000 running on a
computer that has been assigned a certificate from a public certification
authority. The computer on which the application is running must also have a
root CA certificate from the same authority"
John
"norrad" wrote:

> Hello
> I think that I have read every paper on the Internet about SSL and SQL
> 2000 and have "pains takingly" tried to implement every suggestion.
> 1. I have a certificate from Thawte installed on a Windows 2000 server
> that also has SQL 2000 installed.
> 2. The name of the certificate is a FQDN.
> 3. I can set Force Encryption on the Server side, restart the SQL
> Server and it starts normally.
> 4. I use network monitor and can see network traffic encrypted between
> client and server.
> 5. When I turn off Force Encryption with the "server utility", I
> restart the SQL Server.
> 6. I turn on Force Encrytion on the client side.
> 7. I try to connect to the server with SQL Query and get an SSL Error.
> 8. There is only one certificate on the server.
> 9. I set the "friendly name" on the certificate to the FQDN.
> 10. I have viewed the certificate and I see no errors and the path
> looks good.
> 11. I think that I have all the SPs installed.
> I am assuming that the certificate is installed correctly because when
> I set Force Encryption on the server, SQL Server starts with no
> problem.
> When I reset Force Encryption with the "server utility" -- restart the
> SQL Server -- and set Force Encryption with the "client utility", I get
> the "SSL error" when I try to log in with Query analyzer.
>
> Because the SQL Instance and the client application are on the same
> machine, and because I can see the Thawte Server CA under the Authority
> tab, that the client trusts Thawte. Out of desperation, I even tried to
> do an export and import using IE -- though I did not think that was
> necessary because both client and server are on the same mchine.
>
> This should not be this difficult
> Any help is greatly appreciated.
> Thanks
>
|||Hello
Thanks
The Thawte Server CA is a trusted certification authority. It is
loaded by default with 2000 and because both SQL Server and Client are
on the same box, I should be ok and SQL server does start with the
certificate assigned.-- though I am sure that I am doing something
stupid.
Thanks for taking the time to respond. I have been working on this off
and on for two weeks. I see others with the same problem, I try to be
very carefull and implement the suggestions -- but still I get SSL
error
John Bell wrote:[vbcol=seagreen]
> Hi
> I can't say I have tried this but BOL states (second sentence):
> "SSL encryption works only with instances of SQL Server 2000 running on a
> computer that has been assigned a certificate from a public certification
> authority. The computer on which the application is running must also have a
> root CA certificate from the same authority"
> John
> "norrad" wrote:
|||Hi
I found these by searching the security news group
microsoft.public.sqlserver.security, the first one gives step by step details
on how to enable SSL on a client, you may actually want to try this on a
stand alone client to make sure that nothing else is encrypted, doing it on
the server will force encryption of other things such as DTS packages run
through xp_cmdshell etc.. The second article also states "For the client to
request the SSL encryption, the client computer must trust the server
certificate and the certificate must already exist on the server" You may
want to post the exact error number and message you are getting.
276553 HOW TO: Enable SSL Encryption for SQL Server 2000 with Certificate
Server
http://support.microsoft.com/?id=276553
316898 HOW TO: Enable SSL Encryption for SQL Server 2000 with Microsoft
http://support.microsoft.com/?id=316898
319349 BUG: Turning On the 'Force Protocol Encryption' Option Is
Irreversible
http://support.microsoft.com/?id=319349
John
"norrad" wrote:

> Hello
> Thanks
> The Thawte Server CA is a trusted certification authority. It is
> loaded by default with 2000 and because both SQL Server and Client are
> on the same box, I should be ok and SQL server does start with the
> certificate assigned.-- though I am sure that I am doing something
> stupid.
> Thanks for taking the time to respond. I have been working on this off
> and on for two weeks. I see others with the same problem, I try to be
> very carefull and implement the suggestions -- but still I get SSL
> error
>
> John Bell wrote:
>

Force Encryption on client with Thawte certificate

Hello
I think that I have read every paper on the Internet about SSL and SQL
2000 and have "pains takingly" tried to implement every suggestion.
1. I have a certificate from Thawte installed on a Windows 2000 server
that also has SQL 2000 installed.
2. The name of the certificate is a FQDN.
3. I can set Force Encryption on the Server side, restart the SQL
Server and it starts normally.
4. I use network monitor and can see network traffic encrypted between
client and server.
5. When I turn off Force Encryption with the "server utility", I
restart the SQL Server.
6. I turn on Force Encrytion on the client side.
7. I try to connect to the server with SQL Query and get an SSL Error.
8. There is only one certificate on the server.
9. I set the "friendly name" on the certificate to the FQDN.
10. I have viewed the certificate and I see no errors and the path
looks good.
11. I think that I have all the SPs installed.
I am assuming that the certificate is installed correctly because when
I set Force Encryption on the server, SQL Server starts with no
problem.
When I reset Force Encryption with the "server utility" -- restart the
SQL Server -- and set Force Encryption with the "client utility", I get
the "SSL error" when I try to log in with Query analyzer.
Because the SQL Instance and the client application are on the same
machine, and because I can see the Thawte Server CA under the Authority
tab, that the client trusts Thawte. Out of desperation, I even tried to
do an export and import using IE -- though I did not think that was
necessary because both client and server are on the same mchine.
This should not be this difficult
Any help is greatly appreciated.
ThanksHi
I can't say I have tried this but BOL states (second sentence):
"SSL encryption works only with instances of SQL Server 2000 running on a
computer that has been assigned a certificate from a public certification
authority. The computer on which the application is running must also have a
root CA certificate from the same authority"
John
"norrad" wrote:

> Hello
> I think that I have read every paper on the Internet about SSL and SQL
> 2000 and have "pains takingly" tried to implement every suggestion.
> 1. I have a certificate from Thawte installed on a Windows 2000 server
> that also has SQL 2000 installed.
> 2. The name of the certificate is a FQDN.
> 3. I can set Force Encryption on the Server side, restart the SQL
> Server and it starts normally.
> 4. I use network monitor and can see network traffic encrypted between
> client and server.
> 5. When I turn off Force Encryption with the "server utility", I
> restart the SQL Server.
> 6. I turn on Force Encrytion on the client side.
> 7. I try to connect to the server with SQL Query and get an SSL Error.
> 8. There is only one certificate on the server.
> 9. I set the "friendly name" on the certificate to the FQDN.
> 10. I have viewed the certificate and I see no errors and the path
> looks good.
> 11. I think that I have all the SPs installed.
> I am assuming that the certificate is installed correctly because when
> I set Force Encryption on the server, SQL Server starts with no
> problem.
> When I reset Force Encryption with the "server utility" -- restart the
> SQL Server -- and set Force Encryption with the "client utility", I get
> the "SSL error" when I try to log in with Query analyzer.
>
> Because the SQL Instance and the client application are on the same
> machine, and because I can see the Thawte Server CA under the Authority
> tab, that the client trusts Thawte. Out of desperation, I even tried to
> do an export and import using IE -- though I did not think that was
> necessary because both client and server are on the same mchine.
>
> This should not be this difficult
> Any help is greatly appreciated.
> Thanks
>|||Hello
Thanks
The Thawte Server CA is a trusted certification authority. It is
loaded by default with 2000 and because both SQL Server and Client are
on the same box, I should be ok and SQL server does start with the
certificate assigned.-- though I am sure that I am doing something
stupid.
Thanks for taking the time to respond. I have been working on this off
and on for two weeks. I see others with the same problem, I try to be
very carefull and implement the suggestions -- but still I get SSL
error
John Bell wrote:[vbcol=seagreen]
> Hi
> I can't say I have tried this but BOL states (second sentence):
> "SSL encryption works only with instances of SQL Server 2000 running on a
> computer that has been assigned a certificate from a public certification
> authority. The computer on which the application is running must also have
a
> root CA certificate from the same authority"
> John
> "norrad" wrote:
>|||Hi
I found these by searching the security news group
microsoft.public.sqlserver.security, the first one gives step by step detail
s
on how to enable SSL on a client, you may actually want to try this on a
stand alone client to make sure that nothing else is encrypted, doing it on
the server will force encryption of other things such as DTS packages run
through xp_cmdshell etc.. The second article also states "For the client to
request the SSL encryption, the client computer must trust the server
certificate and the certificate must already exist on the server" You may
want to post the exact error number and message you are getting.
276553 HOW TO: Enable SSL Encryption for SQL Server 2000 with Certificate
Server
http://support.microsoft.com/?id=276553
316898 HOW TO: Enable SSL Encryption for SQL Server 2000 with Microsoft
http://support.microsoft.com/?id=316898
319349 BUG: Turning On the 'Force Protocol Encryption' Option Is
Irreversible
http://support.microsoft.com/?id=319349
John
"norrad" wrote:

> Hello
> Thanks
> The Thawte Server CA is a trusted certification authority. It is
> loaded by default with 2000 and because both SQL Server and Client are
> on the same box, I should be ok and SQL server does start with the
> certificate assigned.-- though I am sure that I am doing something
> stupid.
> Thanks for taking the time to respond. I have been working on this off
> and on for two weeks. I see others with the same problem, I try to be
> very carefull and implement the suggestions -- but still I get SSL
> error
>
> John Bell wrote:
>

Force Encryption on client with Thawte certificate

Hello
I think that I have read every paper on the Internet about SSL and SQL
2000 and have "pains takingly" tried to implement every suggestion.
1. I have a certificate from Thawte installed on a Windows 2000 server
that also has SQL 2000 installed.
2. The name of the certificate is a FQDN.
3. I can set Force Encryption on the Server side, restart the SQL
Server and it starts normally.
4. I use network monitor and can see network traffic encrypted between
client and server.
5. When I turn off Force Encryption with the "server utility", I
restart the SQL Server.
6. I turn on Force Encrytion on the client side.
7. I try to connect to the server with SQL Query and get an SSL Error.
8. There is only one certificate on the server.
9. I set the "friendly name" on the certificate to the FQDN.
10. I have viewed the certificate and I see no errors and the path
looks good.
11. I think that I have all the SPs installed.
I am assuming that the certificate is installed correctly because when
I set Force Encryption on the server, SQL Server starts with no
problem.
When I reset Force Encryption with the "server utility" -- restart the
SQL Server -- and set Force Encryption with the "client utility", I get
the "SSL error" when I try to log in with Query analyzer.
Because the SQL Instance and the client application are on the same
machine, and because I can see the Thawte Server CA under the Authority
tab, that the client trusts Thawte. Out of desperation, I even tried to
do an export and import using IE -- though I did not think that was
necessary because both client and server are on the same mchine.
This should not be this difficult
Any help is greatly appreciated.
ThanksHi
I can't say I have tried this but BOL states (second sentence):
"SSL encryption works only with instances of SQL Server 2000 running on a
computer that has been assigned a certificate from a public certification
authority. The computer on which the application is running must also have a
root CA certificate from the same authority"
John
"norrad" wrote:
> Hello
> I think that I have read every paper on the Internet about SSL and SQL
> 2000 and have "pains takingly" tried to implement every suggestion.
> 1. I have a certificate from Thawte installed on a Windows 2000 server
> that also has SQL 2000 installed.
> 2. The name of the certificate is a FQDN.
> 3. I can set Force Encryption on the Server side, restart the SQL
> Server and it starts normally.
> 4. I use network monitor and can see network traffic encrypted between
> client and server.
> 5. When I turn off Force Encryption with the "server utility", I
> restart the SQL Server.
> 6. I turn on Force Encrytion on the client side.
> 7. I try to connect to the server with SQL Query and get an SSL Error.
> 8. There is only one certificate on the server.
> 9. I set the "friendly name" on the certificate to the FQDN.
> 10. I have viewed the certificate and I see no errors and the path
> looks good.
> 11. I think that I have all the SPs installed.
> I am assuming that the certificate is installed correctly because when
> I set Force Encryption on the server, SQL Server starts with no
> problem.
> When I reset Force Encryption with the "server utility" -- restart the
> SQL Server -- and set Force Encryption with the "client utility", I get
> the "SSL error" when I try to log in with Query analyzer.
>
> Because the SQL Instance and the client application are on the same
> machine, and because I can see the Thawte Server CA under the Authority
> tab, that the client trusts Thawte. Out of desperation, I even tried to
> do an export and import using IE -- though I did not think that was
> necessary because both client and server are on the same mchine.
>
> This should not be this difficult
> Any help is greatly appreciated.
> Thanks
>|||Hello
Thanks
The Thawte Server CA is a trusted certification authority. It is
loaded by default with 2000 and because both SQL Server and Client are
on the same box, I should be ok and SQL server does start with the
certificate assigned.-- though I am sure that I am doing something
stupid.
Thanks for taking the time to respond. I have been working on this off
and on for two weeks. I see others with the same problem, I try to be
very carefull and implement the suggestions -- but still I get SSL
error
John Bell wrote:
> Hi
> I can't say I have tried this but BOL states (second sentence):
> "SSL encryption works only with instances of SQL Server 2000 running on a
> computer that has been assigned a certificate from a public certification
> authority. The computer on which the application is running must also have a
> root CA certificate from the same authority"
> John
> "norrad" wrote:
> > Hello
> >
> > I think that I have read every paper on the Internet about SSL and SQL
> > 2000 and have "pains takingly" tried to implement every suggestion.
> >
> > 1. I have a certificate from Thawte installed on a Windows 2000 server
> > that also has SQL 2000 installed.
> > 2. The name of the certificate is a FQDN.
> > 3. I can set Force Encryption on the Server side, restart the SQL
> > Server and it starts normally.
> > 4. I use network monitor and can see network traffic encrypted between
> > client and server.
> > 5. When I turn off Force Encryption with the "server utility", I
> > restart the SQL Server.
> > 6. I turn on Force Encrytion on the client side.
> > 7. I try to connect to the server with SQL Query and get an SSL Error.
> > 8. There is only one certificate on the server.
> > 9. I set the "friendly name" on the certificate to the FQDN.
> > 10. I have viewed the certificate and I see no errors and the path
> > looks good.
> > 11. I think that I have all the SPs installed.
> >
> > I am assuming that the certificate is installed correctly because when
> > I set Force Encryption on the server, SQL Server starts with no
> > problem.
> >
> > When I reset Force Encryption with the "server utility" -- restart the
> > SQL Server -- and set Force Encryption with the "client utility", I get
> > the "SSL error" when I try to log in with Query analyzer.
> >
> >
> > Because the SQL Instance and the client application are on the same
> > machine, and because I can see the Thawte Server CA under the Authority
> > tab, that the client trusts Thawte. Out of desperation, I even tried to
> > do an export and import using IE -- though I did not think that was
> > necessary because both client and server are on the same mchine.
> >
> >
> >
> > This should not be this difficult
> >
> > Any help is greatly appreciated.
> >
> > Thanks
> >
> >|||Hi
I found these by searching the security news group
microsoft.public.sqlserver.security, the first one gives step by step details
on how to enable SSL on a client, you may actually want to try this on a
stand alone client to make sure that nothing else is encrypted, doing it on
the server will force encryption of other things such as DTS packages run
through xp_cmdshell etc.. The second article also states "For the client to
request the SSL encryption, the client computer must trust the server
certificate and the certificate must already exist on the server" You may
want to post the exact error number and message you are getting.
276553 HOW TO: Enable SSL Encryption for SQL Server 2000 with Certificate
Server
http://support.microsoft.com/?id=276553
316898 HOW TO: Enable SSL Encryption for SQL Server 2000 with Microsoft
http://support.microsoft.com/?id=316898
319349 BUG: Turning On the 'Force Protocol Encryption' Option Is
Irreversible
http://support.microsoft.com/?id=319349
John
"norrad" wrote:
> Hello
> Thanks
> The Thawte Server CA is a trusted certification authority. It is
> loaded by default with 2000 and because both SQL Server and Client are
> on the same box, I should be ok and SQL server does start with the
> certificate assigned.-- though I am sure that I am doing something
> stupid.
> Thanks for taking the time to respond. I have been working on this off
> and on for two weeks. I see others with the same problem, I try to be
> very carefull and implement the suggestions -- but still I get SSL
> error
>
> John Bell wrote:
> > Hi
> >
> > I can't say I have tried this but BOL states (second sentence):
> >
> > "SSL encryption works only with instances of SQL Server 2000 running on a
> > computer that has been assigned a certificate from a public certification
> > authority. The computer on which the application is running must also have a
> > root CA certificate from the same authority"
> >
> > John
> >
> > "norrad" wrote:
> >
> > > Hello
> > >
> > > I think that I have read every paper on the Internet about SSL and SQL
> > > 2000 and have "pains takingly" tried to implement every suggestion.
> > >
> > > 1. I have a certificate from Thawte installed on a Windows 2000 server
> > > that also has SQL 2000 installed.
> > > 2. The name of the certificate is a FQDN.
> > > 3. I can set Force Encryption on the Server side, restart the SQL
> > > Server and it starts normally.
> > > 4. I use network monitor and can see network traffic encrypted between
> > > client and server.
> > > 5. When I turn off Force Encryption with the "server utility", I
> > > restart the SQL Server.
> > > 6. I turn on Force Encrytion on the client side.
> > > 7. I try to connect to the server with SQL Query and get an SSL Error.
> > > 8. There is only one certificate on the server.
> > > 9. I set the "friendly name" on the certificate to the FQDN.
> > > 10. I have viewed the certificate and I see no errors and the path
> > > looks good.
> > > 11. I think that I have all the SPs installed.
> > >
> > > I am assuming that the certificate is installed correctly because when
> > > I set Force Encryption on the server, SQL Server starts with no
> > > problem.
> > >
> > > When I reset Force Encryption with the "server utility" -- restart the
> > > SQL Server -- and set Force Encryption with the "client utility", I get
> > > the "SSL error" when I try to log in with Query analyzer.
> > >
> > >
> > > Because the SQL Instance and the client application are on the same
> > > machine, and because I can see the Thawte Server CA under the Authority
> > > tab, that the client trusts Thawte. Out of desperation, I even tried to
> > > do an export and import using IE -- though I did not think that was
> > > necessary because both client and server are on the same mchine.
> > >
> > >
> > >
> > > This should not be this difficult
> > >
> > > Any help is greatly appreciated.
> > >
> > > Thanks
> > >
> > >
>

Force Encryption Login not working

Hi,
i've enabled the certification authentication login i use SQL 2K5 ENT
my problem is like that: in the client network utility i check the Force protocol encryption and connect
to the server the client can't connect because he doesn't have the certificate install on his machine which it's OK.
the problem is when i remove the Force protocol encryption on the client he connect successfully without the
certificate install on his machine or any thing.
i double check that on the server i've YES on the Force Encryption in the protocols For MSSQLSERVER.
why is that?

THX

Hi Avi,

To clarify, SQL Server does not support any certificate authentication -- certificates are used to facilitate SSL encryption only. When encryption is forced on the client-side, the client will perform server validation to ensure that the certificate came from the correct host. In order for this validation to succeed, the client must trust the root signing authority of the certificate. If the server, and not the client, enforces encryption, then the client will not perform server validation. Furthermore, if a certificate hasn't been provisioned on the server machine, the server will use its self-generated cert for channel encryption. Obviously, the self-generated cert would fail server validation (see this post for more details: http://blogs.msdn.com/dataaccess/archive/2005/08/05/448401.aspx) so this is something to watch out for when forcing client-side encryption. I believe that this explains the behaviour that you are seeing.

Il-Sung.

Force Encryption

I want to configure SQL 2k5 Express so that all connections are encrypted. I've found the documentation that gives the How-To steps, but I don't see the SSL option in the Network Configuration.
Is this possible with the Express edition?
Do I need to do something special with the installation?
Thanks,
OldSam

Yes. It's possible.

Use SQL Server Configuration Manager, right click on "Protocols for MSSQLSERVER" (or other instance) on the left window, chose "Properties". You will see "force encryption" option. This is for server, which will make sure channel is encrypted.

For client, you right click "SQL Native Client Configuration", you can force encryption as well. Client force encryption means that the client will verify the server and make sure the server is the correct one that it tries to connect, it's not actually about channel encryption.

Force Encryption

I need to setup SQL encryption on a remote server running W2k3, SQL2k5 std.
The server doesn't have access to a CA. SQL connections are limited to my
server and IIS running on the same remote server.
Can I use a SelfSSL certificate created with the IIS 6.0 Toolkit when
configuring forcing encryption at the network level? If so, are there any
recommendations or pitfalls?
ThanksWhile I've never had to actually do this, yeah, it should be possible. Just
be careful that you setup the domain correctly in the cert and theoretically
you should be fine.
"BigSam" wrote:

> I need to setup SQL encryption on a remote server running W2k3, SQL2k5 std
.
> The server doesn't have access to a CA. SQL connections are limited to my
> server and IIS running on the same remote server.
> Can I use a SelfSSL certificate created with the IIS 6.0 Toolkit when
> configuring forcing encryption at the network level? If so, are there any
> recommendations or pitfalls?
> Thanks