RE: force protocal encryption ?

From: Kevin McDonnell [MSFT] (kevmc_at_online.microsoft.com)
Date: 01/28/05 

Date: Fri, 28 Jan 2005 00:57:30 GMT

Hi Frank,
   I'll try to address each concern:

1: how much extra resource it will take to do encryption?
-- there is some additional handshakes done to check the certificate during
the initial connection request.
You can see this via network trace. You could also use the SQL client
"Show CLient Statistics" to measure performance with and
without SSL in your environment.

2: What certificate should we use, must we use certicate from public
certification authority?
- The certificate is a Server cert issued to the FQDN of the server. It
has the same requirements a IIS server cert uses.
The subject name == FQDN and not the IP address of the server.

3: how will the client side affected after I turn on force protocal
encryption? should it be transparent to them if we install public
certificate on the server?
-- If you enable it on the Serverside, there is nothing needed on the
client.

4: Can client still connect to server using IP address, or must FQDN is
required?
-- No. You'll need to pass the netbios name or FQDN in the connection
string.

Thanks,

Kevin McDonnell
Microsoft Corporation

This posting is provided AS IS with no warranties, and confers no rights.

Relevant Pages

  • Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
    ... SSL only validates you are talking to a SSL certified server; ... They can simply edit the URL the client program ... can be done by using a X.509 certificate on both ends, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: LDP client authentication fails
    ... I got the LDP working with LDAP server under server client authentication ... I did not installed the certificate in pfx format .. ... Client cert auth won't work without that. ...
    (microsoft.public.windows.server.active_directory)
  • Re: SSL & Man In the Middle Attack
    ... >> it possible for the middle man to intercept all messages from server to me ... > server sends client a signed message along with a digital certificate. ... > client generates a random secret key, ...
    (comp.security.misc)
  • Re: activesync issue
    ... On the SBS 2003 Server open the Server Management console. ... On the "Web Server Certificate" page, choose to create a new Web server ... Install the new certificate which created in above step on mobile device: ... Access to browse the Exchange Server 2003 client after you install ...
    (microsoft.public.windows.server.sbs)
  • [Full-disclosure] VMSA-2006-0010 - SSL sessions not authenticated by VC Clients
    ... X.509 certificate when creating an SSL session, ... Both the client and server need certificates from a mutually-trusted ... VirtualCenter 2.0.1 Patch 1 and VirtualCenter 1.4.1 Patch ...
    (Full-Disclosure)