Encrypting traffic between Sharepoint and SQL

Question

We have a 2013 Environment used by internal and external users. External traffic (external users accessing the extranet site) is encrypted using SSL certs. Internal traffic (internal users to the intranet site) is not encrypted which is fine. We are being
asked by some auditors to encrypt traffic between SharePoint (WFE and APP servers) to SQL backend. What options do we have and how involved each one is? On SQL backend we know we can enforce encryption.
Thanks

Answer 1

When you say just enforce encryption on SQL does that mean no steps to take on SharePoint to facilitate the process? Will traffic be automatically encrypted once encryption is done on SQL?
Absolutely correct! You will need to restart the SQL Server service, which will cause a brief outage for SharePoint, but you do not need to do anything for SharePoint. You'll
probably want a certificate that is trusted by the SharePoint servers. I was personally using a Microsoft Certificate Authority server which hands out certificates to machine names and also hands out root certificates to all machines on the domain
(thus a trusted issuer). I am also using a SQL alias on my SharePoint servers, so the alias/SQL machine name mismatch is not an issue.
Once the SQL Server is set to encrypted, you can use the following T-SQL statement and validate the encrypt_option is TRUE. You may also consider adding a SPN to the SQL Server Service account (MSSQLSvc protocol) to enable Kerberos connections, which are
not only faster, but significantly more secure. You can use the same T-SQL statement to see if connections are using NTLM or Kerberos.
select * from sys.dm_exec_connections
Trevor Seward
Follow or contact me at...
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.