Linked Server & Forced Encryption

  • I recently updated our servers to force encryption.

    Force Encryption = Yes on the MSSQLSERVER Properties.

    I have certificates from IT installed correctly and it has been a success.

    SELECT auth_scheme,encrypt_option FROM sys.dm_exec_connections WHERE session_id = @@spid returns KERBEROS & TRUE.

    One of my linked servers are broken however.

    Queries that previously worked are returning -

    Msg 10054, Level 16, State 1, Line 0

    TCP Provider: An existing connection was forcibly closed by the remote host.

    Any help appreciated as I'm out of my depth as my searches are bringing back answers about TLS

    for reference all servers are win 2019, Microsoft SQL Server 2022 (RTM-CU12-GDR)

     

  • I have been fighting SQL 2022 linked server problems for a couple of days now.

    I do not have a satisfactory solution, but according to this Microsoft article, in SQL 2022 linked servers will not currently work with MSOLEDBSQL19 or with ODBC 18. SQL Native Client (SNAC) has also been removed.

    From that article:

    Currently, MSOLEDBSQL19 prevents the creation of linked servers without encryption and a trusted certificate (a self-signed certificate is insufficient). If linked servers are required, use the existing supported version of MSOLEDBSQL.

    So it seems that at present the only way to connect to a linked server is with MSOLEDBSQL (18).  ODBC 17 mentioned in the above article really isn't an option for linked servers according to this second article:

    Using a SQL Server ODBC driver in a linked server isn't a supported scenario. Other ODBC drivers might have primary support from the vendor and only limited support from Microsoft. For more information, see SQL Server Linked Server Delegation Issues.

    I appreciate any information or conversation on this.

    • This reply was modified 2 days, 10 hours ago by  David Rueter.
    • This reply was modified 2 days, 9 hours ago by  David Rueter.
  • David Rueter wrote:

    (a self-signed certificate is insufficient)

    You might be able to get a self-signed certificate to work by importing it into the client as well as the server.

     

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply