I am forcing encryption on my MS SQL server. My intention is to reject any client connection that does not use SSL to connect.

Here are my detailed steps :

  • makecert -r -pe -n "CN=slc02xla.company.com" -b 01/01/2000 -e 01/01/2036 -eku -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 c:\my.cer
  • I imported the same certificate into the trusted Root Certification Authorities Store
  • In SQL Server Configuration Manager, expandrf SQL Server Network Configuration, right-clicked Protocols for , and then selected Properties.
  • On the Certificate tab, selected the desired certificate from the Certificate drop-down menu, and then clicked OK.
  • On the Flags tab, selected Yes in the ForceEncryption box, and then clicked OK to close the dialog box.
  • Restarted the SQL Server service.

Why in the world are my clients who don't specify encrypt=true in their connection strings are still able to connect?


10 seconds google lead to:


Let me quote:

When the Force Encryption option for the Database Engine is set to YES, all communications between client and server is encrypted no matter whether the “Encrypt connection” option (such as from SSMS) is checked or not. You can check it using the following DMV statement.

Clear enough?

More details under the link. And yes, nothing should stop you from using google occasionally. I just looked for "sql server ForceEncryption". Second hit had the needed title.

  • @Codrguy if you're still unsure you can always test it by throwing a packet sniffer from the client to the server. The majority of the times the problems with encryption in SQL server is an improperly configured/ordered/installed certificate and not the connection from client to server. – Techie Joe Nov 13 '13 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.