Setting Encryption Options on Target Servers
If you cannot use a certificate for Secure Sockets Layer (SSL) encrypted communications between master servers and some or all of your target servers, but you want to encrypt the channel between them, configure the target server to use the level of security required.
To configure the appropriate level of security required for a specific master server/target server communication channel, set the SQL Server Agent registry subkey \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\<instance_name>\SQLServerAgent\MsxEncryptChannelOptions(REG_DWORD) on the target server to one of the following values. The value of <instance_name> is **MSSQL.**n. For example, MSSQL.1 or MSSQL.3.
Value |
Description |
|---|---|
0 |
Disables encryption between this target server and the master server. Choose this option only when the channel between the target server and master server is secured by another means. |
1 |
Enables encryption only between this target server and the master server, but no certificate validation is required. |
2 |
Enables full SSL encryption and certificate validation between this target server and the master server. This setting is the default. Unless you have specific reason to choose a different value, we recommend not changing it. |
If 1 or 2 is specified, you must have SSL enabled on both the master and target servers. If 2 is specified, you must also have a properly signed certificate present on the master server. For more information about enabling SSL for SQL Server, see Encrypting Connections to SQL Server.
Warning
Incorrectly editing the registry can severely damage your system. Before making changes to the registry, we recommend that you back up any valued data on the computer.