Skip to content

Commit 86a020d

Browse files
denreadenrea
authored
Merge pull request #34544 from rwestMSFT/rw-0626-fix-10126
Refresh SNAC article (PR 10126)
2 parents 92e28e1 + ee8ed5e commit 86a020d

File tree

1 file changed

+45
-42
lines changed

1 file changed

+45
-42
lines changed

‎docs/relational-databases/native-client/features/using-encryption-without-validation.md

Lines changed: 45 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ title: "Using Encryption Without Validation"
33
description: Learn how the SQL Server Native Client OLE DB provider and ODBC driver support encryption without validation and recommendations for when to use it.
44
author: markingmyname
55
ms.author: maghan
6-
ms.date: "12/21/2017"
6+
ms.reviewer: randolphwest
7+
ms.date: 06/26/2025
78
ms.service: sql
89
ms.subservice: native-client
910
ms.topic: "reference"
@@ -14,46 +15,48 @@ helpviewer_keywords:
1415
- "encryption [SQL Server Native Client]"
1516
- "SQL Server Native Client, encryption"
1617
---
17-
# Using Encryption Without Validation in SQL Server Native Client
18+
# Use encryption without validation in SQL Server Native Client
19+
1820
[!INCLUDE [SQL Server](../../../includes/applies-to-version/sql-asdb-asdbmi-asa-pdw.md)]
1921

20-
> [!IMPORTANT]
21-
> [!INCLUDE[snac-removed-oledb-and-odbc](../../../includes/snac-removed-oledb-and-odbc.md)]
22-
23-
[!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)] always encrypts network packets associated with logging in. If no certificate has been provisioned on the server when it starts up, [!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)] generates a self-signed certificate which is used to encrypt login packets.
24-
25-
Self-signed certificates do not guarantee security. The encrypted handshake is based on NT LAN Manager (NTLM). It is highly recommended that you provision a verifiable certificate on SQL Server for secure connectivity. Transport Security Layer (TLS) can be made secure only with certificate validation.
26-
27-
Applications may also request encryption of all network traffic by using connection string keywords or connection properties. The keywords are "Encrypt" for ODBC and OLE DB when using a provider string with **IDbInitialize::Initialize**, or "Use Encryption for Data" for ADO and OLE DB when using an initialization string with **IDataInitialize**. This may also be configured by [!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)] Configuration Manager using the **Force Protocol Encryption** option, and by configuring the client to request encrypted connections. By default, encryption of all network traffic for a connection requires that a certificate be provisioned on the server. By setting your client to trust the certificate on the server, you might become vulnerable to man-in-the-middle attacks. If you deploy a verifiable certificate on the server, ensure that you change the client settings about trust the certificate to FALSE.
28-
29-
For information about connection string keywords, see [Using Connection String Keywords with SQL Server Native Client](../../../relational-databases/native-client/applications/using-connection-string-keywords-with-sql-server-native-client.md).
30-
31-
To enable encryption to be used when a certificate has not been provisioned on the server, [!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)] Configuration Manager can be used to set both the **Force Protocol Encryption** and the **Trust Server Certificate** options. In this case, encryption will use a self-signed server certificate without validation if no verifiable certificate has been provisioned on the server.
32-
33-
Applications may also use the "TrustServerCertificate" keyword or its associated connection attribute to guarantee that encryption takes place. Application settings never reduce the level of security set by [!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)] Client Configuration Manager, but may strengthen it. For example, if **Force Protocol Encryption** is not set for the client, an application may request encryption itself. To guarantee encryption even when a server certificate has not been provisioned, an application may request encryption and "TrustServerCertificate". However, if "TrustServerCertificate" is not enabled in the client configuration, a provisioned server certificate is still required. The following table describes all cases:
34-
35-
|Force Protocol Encryption client setting|Trust Server Certificate client setting|Connection string/connection attribute Encrypt/Use Encryption for Data|Connection string/connection attribute Trust Server Certificate|Result|
36-
|----------------------------------------------|---------------------------------------------|------------------------------------------------------------------------------|----------------------------------------------------------------------|------------|
37-
|No|N/A|No (default)|Ignored|No encryption occurs.|
38-
|No|N/A|Yes|No (default)|Encryption occurs only if there is a verifiable server certificate, otherwise the connection attempt fails.|
39-
|No|N/A|Yes|Yes|Encryption always occurs, but may use a self-signed server certificate.|
40-
|Yes|No|Ignored|Ignored|Encryption occurs only if there is a verifiable server certificate, otherwise the connection attempt fails.|
41-
|Yes|Yes|No (default)|Ignored|Encryption always occurs, but may use a self-signed server certificate.|
42-
|Yes|Yes|Yes|No (default)|Encryption occurs only if there is a verifiable server certificate, otherwise the connection attempt fails.|
43-
|Yes|Yes|Yes|Yes|Encryption always occurs, but might use a self-signed server certificate.|
44-
45-
> [!CAUTION]
46-
> The preceding table only provides a guide on the system behavior under different configurations. For secure connectivity, ensure that the client and server both require encryption. Also ensure that the server has a verifiable certificate, and that the **TrustServerCertificate** setting on the client is set to FALSE.
47-
48-
## SQL Server Native Client OLE DB Provider
49-
The [!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)] Native Client OLE DB provider supports encryption without validation through the addition of the SSPROP_INIT_TRUST_SERVER_CERTIFICATE data source initialization property, which is implemented in the DBPROPSET_SQLSERVERDBINIT property set. In addition, a new connection string keyword, "TrustServerCertificate", as been added. It accepts yes or no values; no is the default. When using service components, it accepts true or false values; false is the default.
50-
51-
For more information about enhancements made to the DBPROPSET_SQLSERVERDBINIT property set, see [Initialization and Authorization Properties](../../../relational-databases/native-client-ole-db-data-source-objects/initialization-and-authorization-properties.md).
52-
53-
## SQL Server Native Client ODBC Driver
54-
The [!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)] Native Client ODBC driver supports encryption without validation through additions to the [SQLSetConnectAttr](../../../relational-databases/native-client-odbc-api/sqlsetconnectattr.md) and [SQLGetConnectAttr](../../../relational-databases/native-client-odbc-api/sqlgetconnectattr.md) functions. SQL_COPT_SS_TRUST_SERVER_CERTIFICATE has been added to accept either SQL_TRUST_SERVER_CERTIFICATE_YES or SQL_TRUST_SERVER_CERTIFICATE_NO, with SQL_TRUST_SERVER_CERTIFICATE_NO being the default. In addition, a new connection string keyword, "TrustServerCertificate", has been added. It accepts yes or no values; "no" is the default.
55-
56-
## See Also
57-
[SQL Server Native Client Features](../../../relational-databases/native-client/features/sql-server-native-client-features.md)
58-
59-
22+
> [!IMPORTANT]
23+
> [!INCLUDE [snac-removed-oledb-and-odbc](../../../includes/snac-removed-oledb-and-odbc.md)]
24+
25+
[!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] always encrypts network packets associated with logging in. If no certificate was provisioned on the server when it starts up, [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] generates a self-signed certificate that is used to encrypt login packets.
26+
27+
Self-signed certificates don't guarantee security. The encrypted handshake is based on NT LAN Manager (NTLM). You should provision a verifiable certificate on SQL Server for secure connectivity. Transport Security Layer (TLS) can be made secure only with certificate validation.
28+
29+
Applications can also request encryption of all network traffic by using connection string keywords or connection properties. The keywords are "Encrypt" for ODBC and OLE DB when using a provider string with `IDbInitialize::Initialize`, or "Use Encryption for Data" for ADO and OLE DB when using an initialization string with `IDataInitialize`. This can also be configured by [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] Configuration Manager using the **Force Protocol Encryption** option, and by configuring the client to request encrypted connections. By default, encryption of all network traffic for a connection requires that a certificate is provisioned on the server. By setting your client to trust the certificate on the server, you're vulnerable to man-in-the-middle attacks. If you deploy a verifiable certificate on the server, ensure that you change the client settings about trust the certificate to `FALSE`.
30+
31+
For information about connection string keywords, see [Using Connection String Keywords with SQL Server Native Client](../applications/using-connection-string-keywords-with-sql-server-native-client.md).
32+
33+
To enable encryption to be used when a certificate isn't provisioned on the server, [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] Configuration Manager can be used to set both the **Force Protocol Encryption** and the **Trust Server Certificate** options. In this case, encryption uses a self-signed server certificate without validation if no verifiable certificate was provisioned on the server.
34+
35+
Applications can also use the `TrustServerCertificate` keyword or its associated connection attribute to guarantee that encryption takes place. Application settings never reduce the level of security set by [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] Client Configuration Manager, but could strengthen it. For example, if **Force Protocol Encryption** isn't set for the client, an application might request encryption itself. To guarantee encryption even when a server certificate isn't provisioned, an application might request encryption and `TrustServerCertificate`. However, if `TrustServerCertificate` isn't enabled in the client configuration, a provisioned server certificate is still required. The following table describes all cases:
36+
37+
| Force Protocol Encryption client setting | Trust Server Certificate client setting | Connection string/connection attribute Encrypt/Use Encryption for Data | Connection string/connection attribute Trust Server Certificate | Result |
38+
| --- | --- | --- | --- | --- |
39+
| No | N/A | No (default) | Ignored | No encryption occurs. |
40+
| No | N/A | Yes | No (default) | Encryption occurs only if there's a verifiable server certificate, otherwise the connection attempt fails. |
41+
| No | N/A | Yes | Yes | Encryption always occurs, but might use a self-signed server certificate. |
42+
| Yes | No | Ignored | Ignored | Encryption occurs only if there's a verifiable server certificate, otherwise the connection attempt fails. |
43+
| Yes | Yes | No (default) | Ignored | Encryption always occurs, but might use a self-signed server certificate. |
44+
| Yes | Yes | Yes | No (default) | Encryption occurs only if there's a verifiable server certificate, otherwise the connection attempt fails. |
45+
| Yes | Yes | Yes | Yes | Encryption always occurs, but might use a self-signed server certificate. |
46+
47+
> [!CAUTION]
48+
> The preceding table only provides a guide on the system behavior under different configurations. For secure connectivity, ensure that both the client and server require encryption. Also ensure that the server has a verifiable certificate, and that the `TrustServerCertificate` setting on the client is set to `FALSE`.
49+
50+
## SQL Server Native Client OLE DB Provider
51+
52+
The [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] Native Client OLE DB provider supports encryption without validation through the addition of the `SSPROP_INIT_TRUST_SERVER_CERTIFICATE` data source initialization property, which is implemented in the `DBPROPSET_SQLSERVERDBINIT` property set. In addition, a new connection string keyword, `TrustServerCertificate`, was added. It accepts `yes` or `no` values; `no` is the default. When using service components, it accepts `true` or `false` values; `false` is the default.
53+
54+
For more information about enhancements made to the `DBPROPSET_SQLSERVERDBINIT` property set, see [Initialization and Authorization Properties (Native Client OLE DB Provider)](../../native-client-ole-db-data-source-objects/initialization-and-authorization-properties.md).
55+
56+
## SQL Server Native Client ODBC Driver
57+
58+
The [!INCLUDE [ssNoVersion](../../../includes/ssnoversion-md.md)] Native Client ODBC driver supports encryption without validation through additions to the [SQLSetConnectAttr](../../native-client-odbc-api/sqlsetconnectattr.md) and [SQLGetConnectAttr](../../native-client-odbc-api/sqlgetconnectattr.md) functions. `SQL_COPT_SS_TRUST_SERVER_CERTIFICATE` was added to accept either `SQL_TRUST_SERVER_CERTIFICATE_YES` or `SQL_TRUST_SERVER_CERTIFICATE_NO`, with `SQL_TRUST_SERVER_CERTIFICATE_NO` being the default. In addition, a new connection string keyword, `TrustServerCertificate`, was added. It accepts `yes` or `no` values; `no` is the default.
59+
60+
## Related content
61+
62+
- [SQL Server Native Client Features](sql-server-native-client-features.md)

0 commit comments

Comments
 (0)