SQL Server – Compatibility with New TLS Standards

connectivitySecuritysql serverssl

  • The major browsers are moving beyond SSL3.0 and TLS1.0 .
  • The PCI Security Council has declared an end-of-life date for these
    protocols to be considered sufficiently strong encryption.

We need to move away from these protocols, to use newer and stronger ones.
On Windows servers, you can very easily disable these old protocols, and instead offer only TLS1.1 or greater. However, as noted elsewhere, Microsoft SQL Server 2008 R2 and SQL Server 2012 (Standard, at least) both will not start if those lower protocols are disabled. However, there are a growing number of versions of MS SQL Server. There are SQL Server Standard, Business Intelligence, Enterprise, Express, Web, and Compact editions. And of course there is SQL Server 2008, 2012, 2014, and (in pre-release) 2016.

Which of these editions support or will support the use of only TLS1.1 or greater protocols?

Best Answer

Microsoft has recently revealed (without a lot of fanfare) that they will be investing in TLS 1.2 and phasing out SSL. It should be relevant to all editions of SQL Server.

UPDATE 2016-01-29 : Microsoft has announced official support for TLS 1.2 in 2008, 2008 R2, 2012, & 2014. Downloads and other info can be found in KB #3135244.

I blogged about a few of the issues that have been mentioned, as well as a warning if you are using encrypted endpoints in 2014:

The post also points to the correct build to download (or other action) depending on @@version.

Whether this move will affect all existing versions, just 2014 and above, or just 2016, remains to be seen. The quote below seems to imply at least 2014 will be part of the work - and I suspect much of the investment will be in the client libraries, not in the engine, so it is feasible that it will work for any version that the next release of the ODBC/Native Client drivers will support.

I got this from a PowerPoint deck by Kevin Farlee of Microsoft, and was given permission to share the information, though I don't know how much of it has been redistributed at this point. Here is the exact quote from the deck:

Encryption in flight: Protects data between client and server against snooping & man-in-the-middle attacks. Upgrading to TLS 1.2 in CY 15, phasing out SSL.

Also if you look at KB #3052404, it seems there are patches to make it work with 2012 SP+ and 2014 (patches won't be required for 2016), but no indication there will be any back-porting to SQL Server 2005, 2008, or 2008 R2 (and frankly, I'd be quite surprised).