Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are required to use encryption with SQL Server, so we have enabled ForceEncryption. According to the documentation, if a certificate is not provided, SQL Server will generate its own internal certificate to do the encrypting.

We need to understand what level of encryption this is providing. I think we generally use 2048bit certs.

Which certificate store is the internal/fallback certificate located? And how can we get the encryption level?

share|improve this question
up vote 1 down vote accepted

By default, the certificate is located in the registry, at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL.x\MSSQLServer\SuperSocketNetLib

(Where the MSSQL.x is MSSQL.x is a placeholder for the corresponding value of the instance of SQL Server.)

If SQL server cannot find a certificate at that location, it will fall back to searching the certificate store for a certificate with the FQDN of the computer it is installed on. By default, that certificate would be the machine certificate, found in Local Computer -> Personal -> Certificates through the MMC Certificates snap-in.

You would check the key length (and other properties) of this (or any) certificate through the MMC Certificates snap-in, by browsing to it, double clicking on it, and then hitting the Details tab in the ensuing dialogue box that comes up for the certificate.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.