MS SQL Server accepts non-SSL connections even with Force Encryption enabled on the server side

Yes, this is correct. It's also described here Enable Encrypted Connections to the Database Engine (SQL Server Configuration Manager) And maybe also this discussion helps: force-encryption-on-sql-server-not-working


There are two ways to encrypt the SSL connection.

  1. Configure server for all the incoming client request for SSL.

  2. Selective client configuration.

In the first case if you installed certificate on the server and make "Force encryption to yes" then no matter which client is querying for connection, it will always create SSL connection.

In the second case you need to have the same certificate installed on server and client (trust root certificate authorities store) machine.Then it will create SSL connection for that client otherwise it will fail to establish SSL Connection (provided you check the Encrypt connection in SSMS). If Encrypt connection is not checked then it will create connection but not secured (SSL).