cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Decoding MS SQL TDS over SSL

wongcs
Inactive

Hi Guys,

Any one have experience with decoding MS SQL over SSL successfully ?

I am over at customer site doing a PoC and Gigamon HB-1 was used to decrypting the SSL but I discover that it is not decrypting it. How I know it is not decrypting is that any non successfuly decrypt SSL will still be forward to AMD.

Hence, over at the AMD, doing a `show ssldecr servers`, i can see that the encrypted DB traffic is there. I did try to load the ssl key into AMD and it seem that it is not decrypting too.

Anyone have experience on this area ?

4 REPLIES 4

Erik_Soderquist
Dynatrace Pro
Dynatrace Pro

The normal TDS decode should work fine for both encrypted and non-encrypted MS SQL as long as the correct key is present. I've done this many times. When there are issues, I've usually found it is not the correct key for the certificate the SQL server is presenting.

-- Erik

Experiencing the same at our site. Would love to know how to address this as well.

Hello Martin,

Check the similar post, might be helpful in your case:

https://answers.dynatrace.com/questions/160903/how-to-decrypt-symmetric-sql-encrypted-traffic.html

Regards,

Babar

Erik_Soderquist
Dynatrace Pro
Dynatrace Pro

In working on this in the past, the default install of MS SQL will create a default SSL certificate that will be used should the server allow and client requests encryption or the server simply requires it. Microsoft provides no supported way to export the private key for this default certificate.

The only way forward I have found in this scenario is to get/create a certificate externally and import that certificate for the SQL server to use, also putting the private key for this certificate on the AMD. In my experience, as long as the SQL server uses a certificate the AMD has a matching private key for, the AMD can decrypt and analyze the SQL sessions without issue.

-- Erik