Hi,

We want to enable Geo-Replication in Azure SQL Database. However for compliance reasons, we want to be sure that replication to secondary region happens over a secure encrypted channel.

Is there any documentation available to confirm that data in-transit during geo-replication goes over a secure encrypted channel?

I have looked into Microsoft Azure Trust center and there is a brief mention about using standard protocols for in-transit data. However I could not find information related to which protocols are used and how security of in-transit data is ensured. 

Thanks,
Gaurav

Hi Gaurav,

I think by default it is not encrypted.

So you need to ether procure a private channel that allows encyption, or perhaps use OpenSSH.

Hi Gaurav, SQL database geo-replication uses secure channel. If you are using V11 servers the SSL certificates are global and regularly rotated. If you are using V12 servers the certificates are scoped to the individual logical servers. This provides secure channel isolation not only between different customers but also between different applications. Based on this post I have filed a work time to reflect this in the documentation as well.

• Proposed as answer by Joseph IdziorekMicrosoft employee 7 hours 15 minutes ago

Hi Gaurav, SQL database geo-replication uses secure channel. If you are using V11 servers the SSL certificates are global and regularly rotated. If you are using V12 servers the certificates are scoped to the individual logical servers. This provides secure channel isolation not only between different customers but also between different applications. Based on this post I have filed a work time to reflect this in the documentation as well.

• Proposed as answer by Joseph IdziorekMicrosoft employee 7 hours 4 minutes ago

Hi Gaurav, SQL database geo-replication uses secure channel. If you are using V11 servers the SSL certificates are global and regularly rotated. If you are using V12 servers the certificates are scoped to the individual logical servers. This provides secure channel isolation not only between different customers but also between different applications. Based on this post I have filed a work time to reflect this in the documentation as well.

• Proposed as answer by Joseph IdziorekMicrosoft employee Saturday, September 05, 2015 12:06 AM

Hi Gaurav, SQL database geo-replication uses secure channel. If you are using V11 servers the SSL certificates are global and regularly rotated. If you are using V12 servers the certificates are scoped to the individual logical servers. This provides secure channel isolation not only between different customers but also between different applications. Based on this post I have filed a work time to reflect this in the documentation as well.

• Proposed as answer by Joseph IdziorekMicrosoft employee Saturday, September 05, 2015 12:06 AM
• Marked as answer by Casey KarstMicrosoft employee, Moderator 13 hours 49 minutes ago

Hi Gaurav, SQL database geo-replication uses secure channel. If you are using V11 servers the SSL certificates are global and regularly rotated. If you are using V12 servers the certificates are scoped to the individual logical servers. This provides secure channel isolation not only between different customers but also between different applications. Based on this post I have filed a work time to reflect this in the documentation as well.

• Proposed as answer by Joseph IdziorekMicrosoft employee Saturday, September 05, 2015 12:06 AM
• Marked as answer by Casey KarstMicrosoft employee, Moderator Tuesday, September 08, 2015 5:17 PM

Hi Gaurav, SQL database geo-replication uses secure channel. If you are using V11 servers the SSL certificates are global and regularly rotated. If you are using V12 servers the certificates are scoped to the individual logical servers. This provides secure channel isolation not only between different customers but also between different applications. Based on this post I have filed a work time to reflect this in the documentation as well.

• Proposed as answer by Joseph IdziorekMicrosoft employee Saturday, September 05, 2015 12:06 AM
• Marked as answer by Casey KarstMicrosoft employee, Moderator Tuesday, September 08, 2015 5:17 PM