I'm developing an application that will connect to Microsoft SQL Server in a local network:

  • I'm considering whether these connections need to use TLS
  • Or whether to leave it to the customer's administrators to use an encrypted tunnel, if they see fit. they may have other third party applications, also connecting to SQL Server.

But i'm not familiar with the solutions available to administrators to use an encrypted tunnel, besides VPN (and maybe a load balancer?).


  • What would you do?
  • What are the disadvantages to not using TLS in this context?
  • Are there any solutions available for sending connections through an encrypted tunnel? (examples of products please)

I would prefer the simpler case, where i'm not responsible for the encryption


I expect that SQL Server will be running in a local network

  • I'm not sure what to make out of your question, since too much information are missing. Do you use an existing SQL server instance or do you install your own? Is your question about supporting TLS (i.e. if provided by the server) or enforcing TLS (i.e. denying plain access)? Is this against a SQL server on the local machine, in a controlled (local) network or somewhere on the internet? Commented Apr 12, 2021 at 11:12
  • @SteffenUllrich i'm connecting to an existing SQL Server instance. i expect SQL Server to run in a local network
    – symbiont
    Commented Apr 12, 2021 at 11:19
  • Sorry, looks like it is easy to miss the middle one of three questions. To repeat "Is your question about supporting TLS (i.e. if provided by the server) or enforcing TLS (i.e. denying plain access)?" Commented Apr 12, 2021 at 12:33

2 Answers 2


You don't need to do anything specific in this regard. If you need secure channel to SQL server, just insert encrypt=true in SQL connection string. This will request secure channel. The behavior of connection is controlled using TrustServerCertificate connection parameter. If it is set to True, client will fallback to insecure transport (if SQL server does not implement TLS) and will accept arbitrary certificate (potentially, untrusted, or MITM) when presented by server.

By default and when not configured, SQL server automatically generate a self-signed certificate to clients that require secure transport. If TrustServerCertificate is set to False, then client will fail if either, SQL does not implement TLS or server certificate is not valid according to validation rules. ADO.NET clients use Windows built-in certificate chaining engine to validate server certificate.

That's all what you shall to do regarding transport security for SQL client. If you expose connection string altering to systems administrators or application users, leave it up to management personnel.


In general: use TLS. Only if the data stays within a limited network that is not accessible from the outside, you might possibly get away to do it without TLS.

There are a number of options for creating an encrypted tunnel, among which IPSec and OpenVPN. Although possible, all administrators will first frown upon your lack of TLS support and then curse you for requiring them to build the tunnel. All require additional software, and all are harder to configure than simply using TLS. Some may need additional hardware to run reliably.

The only valid reason for not doing TLS is that you have very high (not just high, VERY high) transaction volumes. In that case, you would adapt your network architecture to accommodate for that quantity of transactions. If that is a possible deployment, you could provide an option to switch it off. But default should be TLS.

In the past, TLS (or SSL at that time) may not not have been common. It is now.

  • this is the kind of considerations that are at play here indeed. the network is indeed not accessible from the outside. i'm wondering how much sense it makes to force all third parties application developers use TLS when the network is not even accessible, and why i should be the one taking care of this requirement
    – symbiont
    Commented Apr 14, 2021 at 11:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .