How to enable encrypted connections to a SQL Server instance?

Question

How can I enable an encrypted network connection to SQL Server? What have I to do on the client and on the server side?

Solution 1

You can let the operating system take care of it via an IPSEC policy. With SQL Server, you must have a trusted SSL certificate, but here's how: Books Online - How to: Enable Encrypted Connections to the Database Engine.

Solution 2

You can configure via server/client network utilities: http://support.microsoft.com/kb/316898

You still need certificates, and to specify encryption in the connection string. We use an offline CA to generate our certificates using OpenSSL, and then install on the clients and server w/ MMC.

Comments

[Adrian Grigore]

Actually you can activate the "force encryption" setting on the server without a trusted certificate, and it will always encrypt incoming connections. The only thing you cannot do in this scenario is activate the "encrypt connection" parameter on the client, because then it will complain about a non-trusted certificate. But that's only relevant for safeguarding against man in the middle attacks, not for making sure that people in your LAN cannot eavesdrop your SQL Server password.