MSSQL: Configuration of certificate verification for TLS connection (#31865)

Fixes #24589

Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>

pkg/tsdb/mssql/mssql.go

@@ -82,7 +82,6 @@ func newInstanceSettings(cfg *setting.Cfg) datasource.InstanceFactoryFunc {
 		if cfg.Env == setting.Dev {
 			logger.Debug("getEngine", "connection", cnnstr)
 		}
-
 		config := sqleng.DataPluginConfiguration{
 			DriverName:        "mssql",
 			ConnectionString:  cnnstr,
@@ -145,8 +144,12 @@ func generateConnectionString(dsInfo sqleng.DataSourceInfo) (string, error) {
 	if addr.Port != "0" {
 		args = append(args, "port", addr.Port)
 	}
-
 	logger.Debug("Generating connection string", args...)
+
+	encrypt := dsInfo.JsonData.Encrypt
+	tlsSkipVerify := dsInfo.JsonData.TlsSkipVerify
+	hostNameInCertificate := dsInfo.JsonData.Servername
+	certificate := dsInfo.JsonData.RootCertFile
 	connStr := fmt.Sprintf("server=%s;database=%s;user id=%s;password=%s;",
 		addr.Host,
 		dsInfo.Database,
@@ -157,13 +160,15 @@ func generateConnectionString(dsInfo sqleng.DataSourceInfo) (string, error) {
 	if addr.Port != "0" {
 		connStr += fmt.Sprintf("port=%s;", addr.Port)
 	}
+	if encrypt == "true" {
+		connStr += fmt.Sprintf("encrypt=%s;TrustServerCertificate=%t;", encrypt, tlsSkipVerify)
+		if hostNameInCertificate != "" {
+			connStr += fmt.Sprintf("hostNameInCertificate=%s;", hostNameInCertificate)
+		}
 
-	if dsInfo.JsonData.Encrypt == "" {
-		dsInfo.JsonData.Encrypt = "false"
-	}
-
-	if dsInfo.JsonData.Encrypt != "false" {
-		connStr += fmt.Sprintf("encrypt=%s;", dsInfo.JsonData.Encrypt)
+		if certificate != "" {
+			connStr += fmt.Sprintf("certificate=%s;", certificate)
+		}
 	}
 	return connStr, nil
 }

pkg/tsdb/sqleng/sql_engine.go

@@ -56,11 +56,13 @@ type JsonData struct {
 	Timescaledb         bool   `json:"timescaledb"`
 	Mode                string `json:"sslmode"`
 	ConfigurationMethod string `json:"tlsConfigurationMethod"`
+	TlsSkipVerify       bool   `json:"tlsSkipVerify"`
 	RootCertFile        string `json:"sslRootCertFile"`
 	CertFile            string `json:"sslCertFile"`
 	CertKeyFile         string `json:"sslKeyFile"`
 	Timezone            string `json:"timezone"`
 	Encrypt             string `json:"encrypt"`
+	Servername          string `json:"servername"`
 	TimeInterval        string `json:"timeInterval"`
 }