Repository navigation
TDS 8.0 and "Strict" encryption option #412
Description
Hello 👋
With the introduction of TDS 8.0, a new Encrypt-option is introduced: "Strict". This option forces encryption to take place directly after opening the TCP socket, ie before Connection::<S>::prelogin(..). After this, no encryption should be negotiated.
What needs to be done:
- Add
tds80feature - Add compile error if tds80-feature is enabled without any of the supported TLS features also enabled
- Add
Strictoption toEncryptionLevel - Negotiate TLS before
prelogin - Update connection string parser to allow
strictinstead of just true/false - (opt) Max TLS version should probably be set to Tls12 in the
create_tls_streamimplementations when tds80 is not enabled as TDS 7.x explicitly states that TLS1.2 is the highest version supported.
https://winprotocoldoc.z19.web.core.windows.net/MS-TDS/%5bMS-TDS%5d-260223.pdf
Additional ref: https://learn.microsoft.com/en-us/sql/relational-databases/security/networking/tds-8?view=sql-server-ver16
Activity
Strict encryption option tiberius-rs#412, hostname_in_certificate opt…
iemejia commentedon May 19, 2026
@olback my excuses I did not notice that you already had a PR for this. Let's see what the maintainers prefer from the implementations (and/or) we can complement them. I have some solid Integration Tests that we could rebase in case they take your implementation. (please excuse me)
olback commentedon May 19, 2026
No worries. I don't expect this (or your PR) to get merged anyway. Development seems to have stopped completely a few years ago.
Microsoft has started work on an official driver, but is not quite production ready yet. See microsoft/mssql-rs and https://crates.io/crates/mssql-tiberius-bridge
feat: TDS 8.0 strict encryption, hostname_in_certificate, client_name…
feat: TDS 8.0 strict encryption, hostname_in_certificate, client_name (…
feat: TDS 8.0 strict encryption, hostname_in_certificate, client_name (…
feat: TDS 8.0 strict encryption, hostname_in_certificate, client_name (…
feat: TDS 8.0 strict encryption, hostname_in_certificate, client_name (…
MattJackson commentedon Sep 18, 2026
FYI: this is implemented in #442 (s4), currently in review. It'll be closed when that PR merges.
feat: TDS 8.0 strict encryption, hostname_in_certificate, client_name (…
MattJackson commentedon Sep 24, 2026
Fixed in #442, shipped in v0.13.0 (https://github.com/tiberius-rs/tiberius/releases/tag/v0.13.0). Closing.