Updating applications to connect to Microsoft SQL Server DB instances using new SSL/TLS certificates

As of January 13, 2023, Amazon RDS has published new Certificate Authority (CA) certificates for connecting to your RDS DB instances using Secure Socket Layer or Transport Layer Security (SSL/TLS). Following, you can find information about updating your applications to use the new certificates.

This topic can help you to determine whether any client applications use SSL/TLS to connect to your DB instances. If they do, you can further check whether those applications require certificate verification to connect.

After you update your CA certificates in the client application trust stores, you can rotate the certificates on your DB instances. We strongly recommend testing these procedures in a development or staging environment before implementing them in your production environments.

For more information about certificate rotation, see Rotating your SSL/TLS certificate. For more information about downloading certificates, see Using SSL/TLS to encrypt a connection to a DB instance or cluster. For information about using SSL/TLS with Microsoft SQL Server DB instances, see Using SSL with a Microsoft SQL Server DB instance.

Determining whether any applications are connecting to your Microsoft SQL Server DB instance using SSL

Check the DB instance configuration for the value of the rds.force_ssl parameter. By default, the rds.force_ssl parameter is set to 0 (off). If the rds.force_ssl parameter is set to 1 (on), clients are required to use SSL/TLS for connections. For more information about parameter groups, see Working with parameter groups.

Run the following query to get the current encryption option for all the open connections to a DB instance. The column ENCRYPT_OPTION returns TRUE if the connection is encrypted.

select SESSION_ID,
    ENCRYPT_OPTION,
    NET_TRANSPORT,
    AUTH_SCHEME
    from SYS.DM_EXEC_CONNECTIONS                
        

This query shows only the current connections. It doesn't show whether applications that have connected and disconnected in the past have used SSL.

Determining whether a client requires certificate verification in order to connect

You can check whether different types of clients require certificate verification to connect.

SQL Server Management Studio

Check whether encryption is enforced for SQL Server Management Studio connections:

For more information about SQL Server Management Studio, see Use SQL Server Management Studio.

Sqlcmd

The following example with the sqlcmd client shows how to check a script's SQL Server connection to determine whether successful connections require a valid certificate. For more information, see Connecting with sqlcmd in the Microsoft SQL Server documentation.

When using sqlcmd, an SSL connection requires verification against the server certificate if you use the -N command argument to encrypt connections, as in the following example.

$ sqlcmd -N -S dbinstance.rds.amazon.com -d ExampleDB                     
                

ADO.NET

In the following example, the application connects using SSL, and the server certificate must be verified.

using SQLC = Microsoft.Data.SqlClient;
 
...
 
    static public void Main()  
    {  
        using (var connection = new SQLC.SqlConnection(
            "Server=tcp:dbinstance.rds.amazon.com;" +
            "Database=ExampleDB;User ID=LOGIN_NAME;" +
            "Password=YOUR_PASSWORD;" + 
            "Encrypt=True;TrustServerCertificate=False;"
            ))
        {  
            connection.Open();  
            ...
        }                                
         

Java

In the following example, the application connects using SSL, and the server certificate must be verified.

String connectionUrl =   
    "jdbc:sqlserver://dbinstance.rds.amazon.com;" +  
    "databaseName=ExampleDB;integratedSecurity=true;" +  
    "encrypt=true;trustServerCertificate=false";                    
           

To enable SSL encryption for clients that connect using JDBC, you might need to add the Amazon RDS certificate to the Java CA certificate store. For instructions, see Configuring the client for encryption in the Microsoft SQL Server documentation. You can also provide the trusted CA certificate file name directly by appending trustStore=path-to-certificate-trust-store-file to the connection string.

Updating your application trust store

You can update the trust store for applications that use Microsoft SQL Server. For instructions, see Encrypting specific connections. Also, see Configuring the client for encryption in the Microsoft SQL Server documentation.

If you are using an operating system other than Microsoft Windows, see the software distribution documentation for SSL/TLS implementation for information about adding a new root CA certificate. For example, OpenSSL and GnuTLS are popular options. Use the implementation method to add trust to the RDS root CA certificate. Microsoft provides instructions for configuring certificates on some systems.

For information about downloading the root certificate, see Using SSL/TLS to encrypt a connection to a DB instance or cluster.

For sample scripts that import certificates, see Sample script for importing certificates into your trust store.