SQL Server End to End Encryption Options I'm familiar with database encryption options for SQL Server such as TDE and ensuring backups / backup locations are encrypted and secured properly.

I'm doing some work for a new client who has asked me to detail options for end to end encryption, in other words, to ensure data sent from database server to application server remains encrypted en route and cannot be intercepted (or rather, interpreted) by any sort of packet monitoring. 

I know about using SSL certificates to encrypt connections to the database, though it is something I have seldom configured. I really don't know if that is an adequate option for end to end encryption as surely this cannot be configured using SQL Server alone? 

In my mind there has to be something at the application end, or on the network route that enables end to end encryption like this?

My knowledge of network security is basically limited to firewall rules and general routing, so I'm looking for options available to me to either research further or put into practice.

I wary that this question will be closed because it is opinion based, so I'm really asking for solid options within SQL Server itself (or within the remit of a DBA) to configure end to end encryption of data.
You are correct; SSL is the official means to support encryption for data in motion.


  Microsoft SQL Server can use Secure Sockets Layer (SSL) to encrypt
  data that is transmitted across a network between an instance of SQL
  Server and a client application. The SSL encryption is performed
  within the protocol layer (technet)


Always Encrypted is a bit deeper. It encrypts the data at the client application before it is transmitted, and never stores it in any unencrypted way. So the data that's encrypted via Always Encrypted is "safe" while in transit and at rest (stored as encrypted data), but the packets themselves are NOT encrypted at the network level. (MS Docs)

So if you want to prevent your DBAs and/or report writers from viewing cleartext data (such as credit card numbers or social security numbers), then Always Encrypted is a possible tool to get that level of security.

But if you don't want a packet monitoring tool to see your database username and password, or to see cleartext data as it moves from DB to application, then you must use SSL.