Azure sql database TLS is always enable?

Deocareza NoevieJean 0
Viewed 45
  • I wrote a java code. In the code, I used com.microsoft.sqlserver.jdbc.SQLServerDataSource to establish a JDBC connection with my Azure sql database . I found that no matter whether I used " ds.setEncrypt(true);" or not, the JDBC connection was encrypted by TLS ( I use wireshark to catch the TCP packaege , all the package is TLS whether I used " ds.setEncrypt(true);" or not ).
  • Why ? I checked many official documents, but I couldn't find the answer . It's too difficult...
  • Azure sql database TLS is always enable ? Are there relevant official documents to prove it ?
  • The question is : I use ds.setEncrypt(true) or not ,even i set this to "false" , the TCP packages are encrypted by TLS . Why ? Below is my code to establish the JDBC connection .
    public static Connection getConnectionObject() {
        SQLServerDataSource ds = new SQLServerDataSource();
        ds.setServerName("azuresqldbserver0821.database.windows.net");
        ds.setDatabaseName("azuresqldb0821");
        ds.setPortNumber(1433);
        ds.setUser("root0817");
        ds.setPassword("<YourStrong@Passw0rd>");

        ds.setEncrypt(false);// I use this method or not ,even i set this to "false" , the TCP packages are encrypted by TLS
        ds.setTrustServerCertificate(true);
        Connection conn;
        try {
            conn = ds.getConnection();
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
        return conn;
    }
}
azure-sql-database tls1.2 azure
1 Answers

When a client first attempts a connection to SQL Azure, it sends an initial connection request. Consider this a "pre-pre-connection" request. At this point the client does not know if TLS/SSL/Encryption is required and waits an answer from SQL Azure to determine if TLS/SSL is indeed required throughout the session (not just the login sequence, the entire connection session). A bit is set on the response indicating so. Then the client library disconnects and reconnects armed with this information.

When you set "Encrypt connection" setting on the connetion string you avoid the "pre-pre-connection", you are preventing any proxy from turning off the encryption bit on the client side of the proxy, this way attacks like man-in-the-middle attack are avoided.

When secure connections are needed, please enable "Encrypt connection" setting.

In-transit encryption to Azure SQL is always enabled.

Transport Layer Security (TLS) was previously known as Secure Sockets Layer (SSL).

Alberto Morillo0
Related