Enhancements to SQL Server Network Connection Security Through Breaking Changes
With the introduction of SQL Server 2022, Microsoft began a new initiative known as secure by default. This was done in response to vulnerabilities discovered in the Tabular Data Stream (TDS) protocol by Summit Security Group that allowed a man-in-the-middle attack. The goal is to protect the network connection between the client and SQL Server. Unfortunately, these are breaking changes that can cause existing code and applications to be unable to connect to SQL Server.
Secure by default requires client drivers to enable encryption for the connection by default unless explicitly disabled, and this can cause the connection to fail. It’s not the use of encryption itself that causes problems. Rather it’s because the certificate used by SQL Server to encrypt the connection is validated by the client to ensure it’s a trusted certificate. A trusted certificate is one issued by a trusted certificate authority. Since most SQL Server instances use a self-signed certificate – which, by definition, is not a trusted certificate – this validation process fails with the result that the connection is not allowed.