First published on MSDN on Jan 05, 2016
Windows Enforcement of Authenticode Code Signing and Timestamping has recently announced a change where Windows (version 7 and higher) and Windows Server will no longer trust any code that is signed with a SHA-1 code signing certificate and that contains a timestamp value greater than January 1, 2016. More information about this announcement is documented
here
.
Recently customers have asked about the impact of the above policy on SQL Server Products. SQL server utilizes SHA-1 in the following places that are not affected by this windows policy:
-
CREATE CERTIFICATE, creates a SHA-1 self-signed certificate intended for use within SQL only as a package for an Asymmetric Key. It’s SHA-1 signature is never validated by Windows during encryption, decryption, signing, and signature validations done via T-SQL DDL and is not impacted by the changes mentioned for Windows.
-
The initial login packet uses a SHA-1 self-signed certificate to protect the user name and password where SSL/TLS is not used. We recommend using a certificate issued by a trusted root authority and utilizing this external certificate with SQL Server for any authentication scenario such as SSL/TLS.
-
All the SQL Server binaries are dual signed SHA-256/ SHA-1 digital signature. This is in compliance with the guidance provided in the windows article mentioned above.
If you are using secure communications between the client and the SQL Server instance, then we recommend using the guidelines mentioned in
our documentation
for using a certificate for encrypted communications. We are also exploring the option of moving to a self-signed certificate which does not use SHA-1.
