Secure access between IIS and SQL Server.

Question

The environment setup has an ASP.NET webservice on IIS 6 connecting to a SQL Server over the network.

I am trying to understand, whether it's possible to secure the calls between IIS and SQL Server 2008. Is it possible? Is it something on the lines of SSL?

thanks for reading!

Answer 1

Assuming your SQL box is on the same network as your iis box hosting the service, and both are tucked away behind a firewall, there's no need for that extra security

Answer 2

If you still want to after Pierreten's answer...

Yes, you can enable SSL Encryption for all SQL Server connections.

SQL Server SSL Encryption, server side, is described here. And in KB 316898 too

• "Server side" requires only a server certificate and all connections are encrypted
• "client side" requires client certs and is optional, and only for that client

Certain client libraries (notably MS JDBC) do not support server side s you may invalidate your host's monitoring (This has happened to me a time or 2)

• a blog entry too

Answer 3

If both machines are in the same domain, an efficient and easy to manage way to secure the link is by using IPsec.