You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/database-engine/availability-groups/windows/configure-replication-for-always-on-availability-groups-sql-server.md
## <aname="step1"></a> 1. Configure the Database Publications and Subscriptions
42
42
**Configure the distributor**
43
43
44
-
The distribution database cannot be placed in an availability group.
44
+
The distribution database cannot be placed in an availability group with SQL Server 2012 and SQL Server 2014. Placing the distribution database into an availability group is supported with SQL 2016 and greater. For more information, see [Configure distribution database in an availability group](../../../relational-databases/replication/configure-distribution-availability-group.md).
45
45
46
46
1. Configure distribution at the distributor. If stored procedures are being used for configuration, run **sp_adddistributor**. Use the *@password* parameter to identify the password that will be used when a remote publisher connects to the distributor. The password will also be needed at each remote publisher when the remote distributor is set up.
47
47
@@ -122,7 +122,7 @@ ALTER AVAILABILITY GROUP 'MyAG'
122
122
For more information, see [Creation and Configuration of Availability Groups (SQL Server)](../../../database-engine/availability-groups/windows/creation-and-configuration-of-availability-groups-sql-server.md).
123
123
124
124
125
-
## <a name="step3"></a> 3. Insure that all of the Secondary Replica Hosts are Configured for Replication
125
+
## <a name="step3"></a> 3. Ensure that all of the Secondary Replica Hosts are Configured for Replication
126
126
At each secondary replica host, verify that [!INCLUDE[ssNoVersion](../../../includes/ssnoversion-md.md)] has been configured to support replication. The following query can be run at each secondary replica host to determine whether replication is installed:
title: "Enable Encrypted Connections to the Database Engine | Microsoft Docs"
3
3
ms.custom: ""
4
-
ms.date: "12/21/2017"
4
+
ms.date: "04/09/2019"
5
5
ms.prod: sql
6
-
ms.prod_service: high-availability
6
+
ms.prod_service: security
7
7
ms.reviewer: ""
8
8
ms.technology: configuration
9
9
ms.topic: conceptual
@@ -18,8 +18,8 @@ helpviewer_keywords:
18
18
- "installing certificates"
19
19
- "security [SQL Server], encryption"
20
20
ms.assetid: e1e55519-97ec-4404-81ef-881da3b42006
21
-
author: MikeRayMSFT
22
-
ms.author: mikeray
21
+
author: VanMSFT
22
+
ms.author: vanto
23
23
manager: craigg
24
24
---
25
25
# Enable Encrypted Connections to the Database Engine
@@ -30,93 +30,101 @@ manager: craigg
30
30
The certificate must be issued for **Server Authentication**. The name of the certificate must be the fully qualified domain name (FQDN) of the computer.
31
31
32
32
Certificates are stored locally for the users on the computer. To install a certificate for use by [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)], you must be running [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Configuration Manager with an account that has local administrator privileges.
33
-
34
-
33
+
35
34
The client must be able to verify the ownership of the certificate used by the server. If the client has the public key certificate of the certification authority that signed the server certificate, no further configuration is necessary. [!INCLUDE[msCoName](../../includes/msconame-md.md)] Windows includes the public key certificates of many certification authorities. If the server certificate was signed by a public or private certification authority for which the client does not have the public key certificate, you must install the public key certificate of the certification authority that signed the server certificate.
36
35
37
36
> [!NOTE]
38
-
> To use encryption with a failover cluster, you must install the server certificate with the fully qualified DNS name of the virtual server on all nodes in the failover cluster. For example, if you have a two-node cluster, with nodes named test1.*\<your company>*.com and test2.*\<your company>*.com, and you have a virtual server named virtsql, you need to install a certificate for virtsql.*\<your company>*.com on both nodes. You can set the value of the **ForceEncryption** option to **Yes**.
37
+
> To use encryption with a failover cluster, you must install the server certificate with the fully qualified DNS name of the virtual server on all nodes in the failover cluster. For example, if you have a two-node cluster, with nodes named test1.*\<your company>*.com and test2.*\<your company>*.com, and you have a virtual server named virtsql, you need to install a certificate for virtsql.*\<your company>*.com on both nodes. You can set the value of the **ForceEncryption** option to **Yes**.
39
38
40
39
> [!NOTE]
41
40
> When creating encrypted connections for an Azure Search indexer to SQL Server on an Azure VM, see [Configure a connection from an Azure Search indexer to SQL Server on an Azure VM](https://azure.microsoft.com/documentation/articles/search-howto-connecting-azure-sql-iaas-to-azure-search-using-indexers/).
42
-
43
-
44
-
## <aname="Provision"></a> To provision (install) a certificate on the server
45
41
46
-
>[!NOTE]
47
-
>Refer to [Certificate Management (SQL Server Configuration Manager)](https://docs.microsoft.com/sql/database-engine/configure-windows/manage-certificates.md) to add a certificate on a single server.
42
+
## Certificate Requirements
43
+
44
+
For SQL Server to load an SSL certificate, the certificate must meet the following conditions:
45
+
46
+
- The certificate must be in either the local computer certificate store or the current user certificate store.
47
+
- The SQL Server Service Account must have the necessary permission to access the SSL certificate.
48
+
- The current system time must be after the **Valid from** property of the certificate and before the Valid to property of the certificate.
49
+
- The certificate must be meant for server authentication. This requires the **Enhanced Key Usage** property of the certificate to specify **Server Authentication (1.3.6.1.5.5.7.3.1)**.
50
+
- The certificate must be created by using the **KeySpec** option of **AT_KEYEXCHANGE**. Usually, the certificate's key usage property (**KEY_USAGE**) will also include key encipherment (**CERT_KEY_ENCIPHERMENT_KEY_USAGE**).
51
+
- The **Subject** property of the certificate must indicate that the common name (CN) is the same as the host name or fully qualified domain name (FQDN) of the server computer. If SQL Server is running on a failover cluster, the common name must match the host name or FQDN of the virtual server and the certificates must be provisioned on all nodes in the failover cluster.
52
+
- SQL Server 2008 R2 and the SQL Server 2008 R2 Native Client support wildcard certificates. Other clients might not support wildcard certificates. For more information, see the client documentation and [KB258858](http://support.microsoft.com/kb/258858).
53
+
54
+
## To provision (install) a certificate on the server
55
+
56
+
> [!NOTE]
57
+
> Refer to [Certificate Management (SQL Server Configuration Manager)](manage-certificates.md) to add a certificate on a single server.
48
58
49
-
1.On the **Start** menu, click **Run**, and in the **Open** box, type **MMC** and click **OK**.
59
+
1. On the **Start** menu, click **Run**, and in the **Open** box, type **MMC** and click **OK**.
50
60
51
-
2.In the MMC console, on the **File** menu, click **Add/Remove Snap-in**.
61
+
2. In the MMC console, on the **File** menu, click **Add/Remove Snap-in**.
52
62
53
-
3.In the **Add/Remove Snap-in** dialog box, click **Add**.
63
+
3. In the **Add/Remove Snap-in** dialog box, click **Add**.
4. In the **Add Standalone Snap-in** dialog box, click **Certificates**, click **Add**.
56
66
57
-
5.In the **Certificates snap-in** dialog box, click **Computer account**, and then click **Finish**.
67
+
5. In the **Certificates snap-in** dialog box, click **Computer account**, and then click **Finish**.
58
68
59
-
6.In the **Add Standalone Snap-in** dialog box, click **Close.**
69
+
6. In the **Add Standalone Snap-in** dialog box, click **Close.**
60
70
61
-
7.In the **Add/Remove Snap-in** dialog box, click **OK**.
71
+
7. In the **Add/Remove Snap-in** dialog box, click **OK**.
62
72
63
-
8.In the **Certificates** snap-in, expand **Certificates**, expand **Personal**, and then right-click **Certificates**, point to **All Tasks**, and then click **Import**.
73
+
8. In the **Certificates** snap-in, expand **Certificates**, expand **Personal**, and then right-click **Certificates**, point to **All Tasks**, and then click **Import**.
64
74
65
75
9. Right-click the imported certificate, point to **All Tasks**, and then click **Manage Private Keys**. In the **Security** dialog box, add read permission for the user account used by the SQL Server service account.
66
76
67
77
10. Complete the **Certificate Import Wizard**, to add a certificate to the computer, and close the MMC console. For more information about adding a certificate to a computer, see your Windows documentation.
68
78
69
79
## To provision (install) a certificate across multiple servers
70
80
71
-
Refer to [Certificate Management (SQL Server Configuration Manager)](https://docs.microsoft.com/sql/database-engine/configure-windows/manage-certificates.md) to add a certificate across multiple servers.
81
+
> [!NOTE]
82
+
> Refer to [Certificate Management (SQL Server Configuration Manager)](manage-certificates.md) to add a certificate across multiple servers.
72
83
73
-
## <aname="Export"></a> To export the server certificate
84
+
## To export the server certificate
74
85
75
-
1.From the **Certificates** snap-in, locate the certificate in the **Certificates** / **Personal** folder, right-click the **Certificate**, point to **All Tasks**, and then click **Export**.
86
+
1. From the **Certificates** snap-in, locate the certificate in the **Certificates** / **Personal** folder, right-click the **Certificate**, point to **All Tasks**, and then click **Export**.
76
87
77
-
2.Complete the **Certificate Export Wizard**, storing the certificate file in a convenient location.
88
+
2. Complete the **Certificate Export Wizard**, storing the certificate file in a convenient location.
78
89
79
-
## <aname="ConfigureServerConnections"></a> To configure the server to force encrypted connections
90
+
## To configure the server to force encrypted connections
80
91
81
-
1.In **SQL Server Configuration Manager**, expand **SQL Server Network Configuration**, right-click **Protocols for**_\<server instance>_, and then select**Properties**.
92
+
1. In **SQL Server Configuration Manager**, expand **SQL Server Network Configuration**, right-click **Protocols for**_\<server instance>_, and then select**Properties**.
82
93
83
-
2.In the **Protocols for**_\<instance name>_ **Properties** dialog box, on the **Certificate** tab, select the desired certificate from the drop-down for the **Certificate** box, and then click **OK**.
94
+
2. In the **Protocols for**_\<instance name>_ **Properties** dialog box, on the **Certificate** tab, select the desired certificate from the drop-down for the **Certificate** box, and then click **OK**.
84
95
85
-
3.On the **Flags** tab, in the **ForceEncryption** box, select **Yes**, and then click **OK** to close the dialog box.
96
+
3. On the **Flags** tab, in the **ForceEncryption** box, select **Yes**, and then click **OK** to close the dialog box.
86
97
87
-
4. Restart the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] service.
88
-
98
+
4. Restart the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] service.
89
99
90
100
> [!NOTE]
91
-
> To ensure secure connectivity between client and server, configure the client to request encrypted connections. More details are explained [later in this article](#client-request-encrypt-connect-23h).
101
+
> To ensure secure connectivity between client and server, configure the client to request encrypted connections. More details are explained [later in this article](#to-configure-the-client-to-request-encrypted-connections).
102
+
103
+
### Wildcard Certificates
92
104
93
-
### Wildcard Certificates
94
105
Beginning with [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] 2008, [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] and the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Native Client support wildcard certificates. Other clients might not support wildcard certificates. For more information, see the client documentation. Wildcard certificate cannot be selected by using the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Configuration Manager. To use a wildcard certificate, you must edit the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQLServer\SuperSocketNetLib` registry key, and enter the thumbprint of the certificate, without spaces, to the **Certificate** value.
<Token>**APPLIES TO:**SQL Server (starting with 2017) Azure SQL Database Azure SQL Data Warehouse Parallel Data Warehouse </Token>
1
+
<Token>**APPLIES TO:**SQL Server (starting with 2019) Azure SQL Database Azure SQL Data Warehouse Parallel Data Warehouse </Token>
Activity Monitor displays information about [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] processes and how these processes affect the current instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)].
19
+
Activity Monitor displays information about [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] processes and how these processes affect the current instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)].
20
20
21
-
Activity Monitor is a tabbed document window with the following expandable and collapsible panes: **Overview**, **Active User Tasks**, **Resource Waits**, **Data File I/O**, and **Recent Expensive Queries**. When any pane is expanded, Activity Monitor queries the instance for information. When a pane is collapsed, all querying activity stops for that pane. You can expand one or more panes at the same time to view different kinds of activity on the instance.
21
+
Activity Monitor is a tabbed document window with the following expandable and collapsible panes: **Overview**, **Processes**, **Resource Waits**, **Data File I/O**, **Recent Expensive Queries**, and **Active Expensive Queries**. When any pane is expanded, Activity Monitor queries the instance for information. When a pane is collapsed, all querying activity stops for that pane. You can expand one or more panes at the same time to view different kinds of activity on the instance.
22
22
23
-
## Customize columns
24
-
For columns included in the **Active User Tasks**, **Resource Waits**, **Data File I/O**, and **Recent Expensive Queries** panes, customize the display as follows:
23
+
## Customize columns
24
+
For columns included in the **Processes**, **Resource Waits**, **Data File I/O**, **Recent Expensive Queries**, and **Active Expensive Queries** panes, customize the display as follows:
25
25
26
26
1. To rearrange column order, click the column heading and drag it to another location in the heading ribbon.
0 commit comments