What is the purpose of setFips() connection property in SQL Server JDBC driver ?

Question

What is the purpose of the setFIPS() connection property? We need to disable hostname validation to test a specific use case, but there doesn’t seem to be a straightforward way to do so. While studying the source code, we noticed that setting FIPS to true causes the driver to use the hostname from the certificate instead. Why does this happen? What is the actual purpose of this property, and is there any official documentation that explains it clearly?

Answer 1

FIPS mode is described here: https://learn.microsoft.com/en-us/sql/connect/jdbc/fips-mode?view=sql-server-ver17. FIPS 140 appears be a US governments standard for cryptography.

The reason that the hostname appears in the TLS certificate is to prevent that you connect to server B when you intended to connect to server A. You would end up at server B, because someone has manipulated the DNS records. Server B may connect you to server A, so you may not notice. But the man-in-the-middle listens to the traffic and steals data. And who knows also distorts data sent in either direction.

I don't know about JDBC, but most other APIs has a connection string option Host Name in Certificate, which you can use, when you cannot connect with the name in the certificate. (For instance, the certificate has only the server name, but you need to use FQDN.)

There is also the option Trust Server Certificate, but that is definitely not secure.