SQL Server TLS and certificates created with ECC algorithm

Question

We've got encrypted connections enabled for several SQL Servers. The certificates are due for renewal & our security guy is asking if SQL Server supports the ECC algorithm for the certificate (sha384ECDSA).

So the question is - does SQL Server support use of certificates created using the sha384ECDSA signature algorithm for enabling connection encryption? Or does it not matter, because that's all handled at the Windows level (or subsystem therein)?

The closest I can find to an answer is "The TLS encryption is performed within the protocol layer and is available to all supported SQL Server clients." from https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/enable-encrypted-connections-to-the-database-engine?view=sql-server-ver15#transport-layer-security-tls. Presumably this means it doesn't matter what algorithm is used for the certificate, as long as Windows supports it.

Answer 1

Hi,

> Or does it not matter, because that's all handled at the Windows level (or subsystem therein)?

SQL Server relies on the SChannel library of Windows to determine what cipher suite to use for SSL/TLS encryption. A series of cryptographic algorithms are defined in the SChannel library for TLS/SSL key exchange, encryption and message verification. The operating systems of SQL Server server and client server negotiate with each other through Schannel to decide which cipher suite to use. The basic principles of consultation are as follows:

1. First, determine the highest level protocol(TLS/SSL) supported by both the client and SQL Server.
2. After deciding on the protocol, the client will provide a list to SQL Server, telling SQL Server all the cipher suites it supports.
3. SQL Server finds the strongest cipher suite it supports in this list.

I think SQL Server supports the use of certificates created using the sha384ECDSA signature algorithm, you may need to ensure that the SQL Server you are using supports TLS 1.2.