SQLServer 2017 Linux版の環境を構築してみたで構築したSQLServerへの接続をLet’s Encryptの証明書を使って暗号化をしてみた

設定メモ

Let’s Encryptの証明書を取得する準備

$ git clone https://github.com/certbot/certbot.git

$ cd certbot

$ ./certbot-auto
Requesting to rerun ./certbot-auto with root privileges...

Let’s Encryptの証明書を取得する

$ ./certbot-auto certonly --standalone -d sqldb.example.com --standalone-supported-challenges http-01
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/sqldb.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/sqldb.example.com/privkey.pem
   Your cert will expire on 20**-**-**. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"

取得した証明書をコピーする

$ sudo mkdir /var/opt/mssql/ssl

$ sudo chown mssql:mssql /var/opt/mssql/ssl

$ sudo cp /etc/letsencrypt/live/sqldb.example.com/cert.pem /var/opt/mssql/ssl

$ sudo cp /etc/letsencrypt/live/sqldb.example.com/privkey.pem /var/opt/mssql/ssl

$ sudo chown mssql:mssql /var/opt/mssql/ssl/*

$ sudo chmod 600 /var/opt/mssql/ssl/*

SQLServerへの接続を暗号化する

$ sudo systemctl stop mssql-server

$ sudo cp /var/opt/mssql/mssql.conf /var/opt/mssql/mssql.conf.orig

$ sudo /opt/mssql/bin/mssql-conf set network.tlscert /var/opt/mssql/ssl/cert.pem

$ sudo /opt/mssql/bin/mssql-conf set network.tlskey /var/opt/mssql/ssl/privkey.pem

$ sudo /opt/mssql/bin/mssql-conf set network.tlsprotocols 1.2 

$ sudo /opt/mssql/bin/mssql-conf set network.forceencryption 0 

$ sudo systemctl start mssql-server 

SQL Server Management Studio(SSMS)で確認してみる

• 「接続プロパティ」で「暗号化接続」にチェックを入れて接続する
  

• 「サーバーのプロパティ」の「接続のプロパティの表示」で「接続」の「暗号化」が「はい」になっていることを確認する