Hi Guys,
Any one have experience with decoding MS SQL over SSL successfully ?
I am over at customer site doing a PoC and Gigamon HB-1 was used to decrypting the SSL but I discover that it is not decrypting it. How I know it is not decrypting is that any non successfuly decrypt SSL will still be forward to AMD.
Hence, over at the AMD, doing a `show ssldecr servers`, i can see that the encrypted DB traffic is there. I did try to load the ssl key into AMD and it seem that it is not decrypting too.
Anyone have experience on this area ?
The normal TDS decode should work fine for both encrypted and non-encrypted MS SQL as long as the correct key is present. I've done this many times. When there are issues, I've usually found it is not the correct key for the certificate the SQL server is presenting.
-- Erik
Experiencing the same at our site. Would love to know how to address this as well.
Hello Martin,
Check the similar post, might be helpful in your case:
https://answers.dynatrace.com/questions/160903/how-to-decrypt-symmetric-sql-encrypted-traffic.html
Regards,
Babar
In working on this in the past, the default install of MS SQL will create a default SSL certificate that will be used should the server allow and client requests encryption or the server simply requires it. Microsoft provides no supported way to export the private key for this default certificate.
The only way forward I have found in this scenario is to get/create a certificate externally and import that certificate for the SQL server to use, also putting the private key for this certificate on the AMD. In my experience, as long as the SQL server uses a certificate the AMD has a matching private key for, the AMD can decrypt and analyze the SQL sessions without issue.
-- Erik
Contributors
12 People are following this article.
