SQL Server 连接是否加密？
我正在编写一个小型桌面应用程序，想知道连接到当前用于网站的托管数据库时会出现什么安全问题。具体来说，我想知道 SQL Server 连接是否已加密，以及从本地应用程序连接到托管（由网络托管公司）的数据库是否安全。
谢谢你，
JP
I am writing a small desktop application and was wondering what the security concerns would be when connecting to a hosted database that is currently used for a website. Specifically, I would like to know if SQL Server connections are encrypted and if it is safe to connect to a hosted (by a web hosting company) database from a local application.
Thank you
JP
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
请参阅 MSDN 的加密与 SQL Server 的连接。简而言之，SSL 加密可以配置。长
的答案是，这取决于您的托管。首先，我怀疑您的托管是否允许 SQL Server 通过互联网公开。其次，如果是这样，由于 SQL Server 没有虚拟主机的概念，因此该实例将与任何人共享，并且您连接的名称将是托管箱名称。他们必须为 SQL Server 使用的主机名安装具有正确主题的 SSL 证书，并正确配置实例以使用此证书（所有详细信息请参见 上面的链接）。
如果 SQL Server 未配置为使用正确命名的证书，则将使用自签名证书。然后，客户端必须配置为信任服务器提供的任何证书，这意味着从客户端到数据库的连接不再安全：攻击者可以相对轻松地发起中间人攻击。
您必须联系您的提供商并获取所有这些详细信息才能了解您的情况。您很可能必须通过一组 Web 服务公开数据库并使用 HTTPS 保护 Web 服务。 （无论如何，这会更好。如果不出意外的话，至少因为它不需要将 SQL Server 端口暴露到网络）。
See MSDN's Encrypting Connections to SQL Server. The short answer is that SSL encryption can be configured.
The long answer is that it will depend on your hosting. First of all, I doubt your hosting will allow the SQL Server to be exposed over the internet. Second, if it does, since SQL Server has no concept of virtual host, the instance will be shared with anyone and the name you connect to will the the hosting box name. They have to install an SSL certificate with proper subject for the hostname to be used by SQL Server and properly configure the instance to use this certificate (all details in the link above).
If SQL Server is not configured to use a properly named certificate, then a self-signed certificate will be used instead. Then the client has to be configured to trust any certificate the server provides, meaning the connection from client to your database is no longer secure: An attacker can mount a man-in-the-middle attack with relative ease.
You have to contact your provider and get all these details to understand your situation. Most likely you'll have to expose the database over a set of web services and protect the web services with HTTPS. (This would be better anyway. If nothing else, then at least because it does not require exposing the SQL Server port to the net).