How to get SQL Server to check revocation status of used certificate?

Thomas Griepentrog 1

Hi all,

we have an issue with SQL Server and the setup of encrypted communication.

We set up the SQL server to use encrypted communication according to the documentation: https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/enable-encrypted-connections-to-the-database-engine?view=sql-server-ver15

But now we have an issue when the used certificate is revoked.

The SQL Server Engine is still able to start and the connections are still possible.

It seems that the SQL Server is not checking if the certificate is revoked or not.

Is there any possible way to enable the checking of the revocation status for the SQL Server?

When we check the certificate using the command line tool "certutil" it clearly states that the certificate has been revoked but the SQL Server Engine doesn't care about it.

CathyJi-MSFT 22,341 Reputation points Microsoft Vendor

2021-12-06T07:54:56.917+00:00

Hi @Thomas Griepentrog ,

We have not received a response from you. Did the reply could help you? If the response helped, do "Accept Answer". If it is not work, please let us know the progress. By doing so, it will benefit all community members who are having this similar issue. Your contribution is highly appreciated.

2 answers

CathyJi-MSFT 22,341 Reputation points Microsoft Vendor

2021-12-03T01:59:03.813+00:00
Hi @Thomas Griepentrog ,

Did you enable certificate revocation checking as below screenshot.

Open Internet Explorer and go to Internet Options. Check the "Check for server certificate revocation" option and reboot your computer.

Or change it at the Group Policy level.

Click Start. Click Run...

Type gpedit.msc and click OK.

Navigate to Computer Configuration / Administrative Templates / Windows Components / Internet Explorer / Internet Control Panel / Advanced Page.

Double-click Check for server certificate revocation.

Select Enabled and click OK.

Reboot the server.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Thomas Griepentrog 1 Reputation point

2021-12-06T16:39:36.837+00:00

Hi @CathyJi-MSFT ,

I tested your provided solution and it worked.

Now I have to check how it's working when the certificate is beeing revoked without restarting the MS SQL Engine or rebooting the server.

I will come back after I checked it tomorrow.

Thomas
Please sign in to rate this answer.
CathyJi-MSFT 22,341 Reputation points Microsoft Vendor

2021-12-07T00:34:23.937+00:00

Hi @Thomas Griepentrog ,

Waiting for your good news.

By the way, if the suggestion is helpful, please "Accept answer" or "Up-Vote" for the same which might be beneficial to other community members reading this thread.

CathyJi-MSFT 22,341 Reputation points Microsoft Vendor

2021-12-08T07:28:26.983+00:00

Hi，
Any update for this thread?

Thomas Griepentrog 1 Reputation point

2021-12-08T08:49:10.227+00:00

Hi @CathyJi-MSFT ,

yes I have an update but a very strange one.

I configured the "Protocols for MSSQLSERVER" with the following settings:

Flags: Force Encryption - YES

Certificate - My certificate from our internal CA-Server

The Application uses the following connection string settings: Encrypt=true;TrustServerCertificate=false

The application is starting when the certificate is configured and, as a surprise for me, even if no certificate is configured (only the flag Force Encryption is active).

When I now revoke the certificate and wait until it is shown in the CRL-File (in our environment it's configured to update the CRL File every 1,5h) the server is still running and the application is still able to use the database connection.

This morning, ~18 hours after the certificate was revoked, the certificate was not on the server anymore (in the local computer store) and the SQL Server had no certificate selected (since it wasn't on the server anymore) but the SQL Server instance was running and the application could connect to the database.

Should I add some Screenshots to show my configuration settings and the certificate settings?

Thomas Griepentrog 1 Reputation point

2022-01-18T08:24:54.237+00:00

Hi @CathyJi-MSFT ,

Should I add some screenshots to show my issue or did I something wrong in configuring the system?

Best regards,

Thomas

armina nikoo 0 Reputation points

2024-01-02T11:37:01.6033333+00:00

i also have the same issue but "Check for server certificate revocation" option did not help... what may cause the problem? can you help?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to get SQL Server to check revocation status of used certificate?

2 answers

Your answer