Configure encrypted communication with SQL Server

New versions related applications might require encrypted communication with SQL Server, for example Sitecore Identity Server module version 8.0 and later. This change is due to the adoption of a newer version of Microsoft.Data.SqlClient that enforces increased security, as described in Microsoft’s Breaking changes in EF Core 7.0 article.

To configure encrypted communication with SQL Server:

1. Install the SitecoreDockerTools module of version 10.4.7 or newer, for example: 

   Install-Module -Name SitecoreDockerTools -MinimumVersion 10.4.7 -Repository SitecoreGallery -Force

   Import-Module -Name SitecoreDockerTools -MinimumVersion 10.4.7 -Force

2. Ensure folders that store certificates for TLS are empty, otherwise the certificates will not be re-created:

   k8s\<version>\<topology>\secrets\tls\global-*

3. Run the k8s-init.ps1 initialization script to generate certificates (described in the following section). You should see three new certificates were created, which are required to configure trusted encrypted communications between the application and SQL Server:

• k8s\<version>\<topology>\secrets\tls\mssql\tls.crt - contains a public certificate that will be used by SQL Server for encryption.
• k8s\<version>\<topology>\secrets\tls\mssql\tls.key - contains a private key that will be used by SQL Server for encryption.
• k8s\<version>\<topology>\secrets\tls\global-authority\root.crt - the public certificate of the certification authority that issued this and other certificates for the Sitecore deployment.

You can provide your own certificates; however, they must meet certain requirements to be used with SQL Server. For details, refer to the Certificate requirements for SQL Server article. Secrets with names mssql-tls and global-authority are created for these certificates, accordingly.

4. If any Sitecore application requires an encrypted communication with SQL Server, you can provide the certification authority certificate from the global-authority secret to it. Details about the configuration are provided in the application's documentation.