Log shows (on SS2005)
“A self-generated certificate was successfully loaded for encryption”
No encryption is used. Properties of Protocol for MSSQLSERVER shows no for Force Encryption, certificates are empty
How, why, where from and what for does it get and load self-generated certificate?
This certificate refers to a self-generated certificate used as a “best-effort” mechanism to protect the SQL login information (including password) when using SQL authentication.
By default this self-signed certificate should only affect the login information and only when using SQL authentication (no penalty for using Windows auth).
Pleaes be aware that because this is a self-signed certificate it is subject to an active attack (i.e. MiM), but it provides a better defense against a passive attacker (“sniffing” passwords) than SQL Server 2000.
For more information refer to BOL:
http://blogs.msdn.com/sql_protocols/archive/2005/11/10/491563.aspx
http://blogs.msdn.com/sql_protocols/archive/2005/10/11/479869.aspx
I hop this information helps
-Raul Garcia
SDE/T
SQL Server Engine
No comments:
Post a Comment