Configuring MS SQL for SSL/TLS

  1. Provide a private key and certificate (.key and .crt files) on both machines.

  2. Configure any non-server clients to trust the certificate's root signing authority. For more information please see: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-sql-server-encryption?view=sql-server-ver17

  3. Configure the server(s) to force all incoming connections to use SSL/TLS so that any clients that do not support this will fail to connect. In SQL Server Configuration Manager, set the ForceEncryption parameter to "Yes" in the Protocols section.

    force-encryption.png

This solution is not bullet-proof. The database links are generally a potential security risk, when the user permissions are not configured properly and e.g. xp_cmdshell with admin rights is accessible on some of the database nodes. For more information please refer to https://blog.netspi.com/how-to-hack-database-links-in-sql-server/.

For more information how to create a certificate please see the chapter System communication hardening

Adding the MSSQL certificate to YSoft SafeQ 6

After configuring SSL/TLS on the MSSQL server, the certificate must be trusted by SafeQ6.

In order to get a fully secured MSSQL connection via certificate, build 117 or above is mandatory.

From version 117 and above: The installer imports the certificate automatically. Have the exported certificate (.cer) ready when running the installation.

Manual import (existing installations on v117+)

Use the keytool command to import the certificate into the SafeQ6 ssl-truststore:

C:\JDK\openjdk21\bin> keytool -importcert -alias mssql-cert -file <PATH_TO_CERT> -keystore <PATH_TO_TRUSTSTORE> -storepass <TRUSTSTORE_PASSWORD> -noprompt

Restart the YSoft SafeQ Management Service after importing the certificate.

Configuration in management-service.properties

After importing the certificate, add or update the following properties in

C:\SafeQ6\Management\conf\management-service.properties:

database.msSql.encrypt = true
database.msSql.trustServerCertificate = false
database.msSql.trustStorePath = C:/SafeQ6/Management/conf/ssl-truststore

For full reference of database configuration properties see YSoft SafeQ Server Requirements - Database Settings and Configuration.