Skip to content

Commit 6fcb5c7

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #27914 from rwestMSFT/rw-0802-refresh-database-content-003
Database content refresh: manage certificates article
2 parents ee93ec8 + dc78557 commit 6fcb5c7

1 file changed

Lines changed: 52 additions & 47 deletions

File tree

‎docs/database-engine/configure-windows/manage-certificates.md‎

Lines changed: 52 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Certificate Management (SQL Server Configuration Manager)
33
description: Learn how to install certificates in various SQL Server configurations. Examples include single instances, failover clusters, and Always On availability groups.
44
author: rwestMSFT
55
ms.author: randolphwest
6-
ms.date: "01/12/2021"
6+
ms.date: 08/02/2023
77
ms.service: sql
88
ms.subservice: configuration
99
ms.topic: conceptual
@@ -18,85 +18,90 @@ helpviewer_keywords:
1818
- "installing certificates"
1919
- "security [SQL Server], encryption"
2020
---
21-
2221
# Certificate Management (SQL Server Configuration Manager)
2322

2423
[!INCLUDE [sql-windows-only](../../includes/applies-to-version/sql-windows-only.md)]
2524

26-
This topic describes how to deploy and manage certificates across your SQL Server Always On Failover Cluster or Availability Group topology.
25+
This article describes how to deploy and manage certificates across your [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] Always On Failover Cluster Instance (FCI) or Availability Group (AG) topology.
26+
27+
SSL/TLS certificates are widely used to secure access to [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)]. With earlier versions of [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)], organizations with large [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] estates had to spend considerable effort to maintain their [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] certificate infrastructure, often through developing scripts and running manual commands.
2728

28-
SSL/TLS certificates are widely used to secure access to SQL Server. With earlier versions of SQL Server, organizations with large SQL Server estates had to spend considerable effort to maintain their SQL Server certificate infrastructure, often through developing scripts and running manual commands. With SQL Server 2019, certificate management is integrated into the SQL Server Configuration Manager, simplifying common tasks such as:
29+
With [!INCLUDE [sssql19-md](../../includes/sssql19-md.md)] and later versions, certificate management is integrated into the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] Configuration Manager, which simplifies the following common tasks:
2930

30-
* Viewing and validating certificates installed in a SQL Server instance.
31-
* Identifying which certificates may be close to expiring.
32-
* Deploying certificates across Always On Availability Group machines from the node holding the primary replica.
33-
* Deploying certificates across machines participating in an Always On failover cluster instance from the active node.
31+
- View and validate certificates installed in a [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] instance.
32+
- Identify which certificates may be close to expiring.
33+
- Deploy certificates across AG machines from the node holding the primary replica.
34+
- Deploy certificates across FCI machines from the active node.
3435

35-
> [!NOTE]
36-
> You can use certificate management in SQL Server Configuration Manager with lower versions of SQL Server, starting with SQL Server 2008.
36+
> [!NOTE]
37+
> You can use certificate management in [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] Configuration Manager with earlier versions of [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)], starting with [!INCLUDE [sql2008-md](../../includes/sql2008-md.md)].
3738
38-
## <a name="provision-single-server-cert"></a> To install a certificate for a single SQL Server instance
39+
## <a id="provision-single-server-cert"></a> Install a certificate for a single SQL Server instance
3940

4041
::: moniker range=">=sql-server-ver15"
41-
1. In SQL Server Configuration Manager, in the console pane, expand **SQL Server Network Configuration**.
42+
1. In [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] Configuration Manager, in the console pane, expand **SQL Server Network Configuration**.
4243

43-
2. Right-click **Protocols for** *&lt;instance Name&gt;*, and then select **Properties**.
44+
1. Right-click **Protocols for** *&lt;instance Name&gt;*, and then select **Properties**.
4445

45-
3. Choose the **Certificate** tab, and then select **Import**.
46+
1. Choose the **Certificate** tab, and then select **Import**.
4647

47-
4. Select **Browse** and then select the certificate file.
48+
1. Select **Browse** and then select the certificate file.
4849

49-
5. Select **Next** to validate the certificate. If there are no errors, select **Next** to import the certificate to the local instance.
50+
1. Select **Next** to validate the certificate. If there are no errors, select **Next** to import the certificate to the local instance.
5051
::: moniker-end
5152

5253
::: moniker range="<= sql-server-2017"
53-
1. In SQL Server Configuration Manager, in the console pane, expand **SQL Server Network Configuration**.
54+
1. In [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] Configuration Manager, in the console pane, expand **SQL Server Network Configuration**.
5455

55-
2. Right-click **Protocols for** *&lt;instance Name&gt;*, and then select **Properties**.
56+
1. Right-click **Protocols for** *&lt;instance Name&gt;*, and then select **Properties**.
5657

57-
3. Select a certificate from the **Certificate** drop-down menu, and then select **Apply**.
58+
1. Select a certificate from the **Certificate** dropdown list menu, and then select **Apply**.
5859

59-
4. Select **OK**.
60+
1. Select **OK**.
6061
::: moniker-end
6162

62-
## <a name="provision-failover-cluster-cert"></a> To install a certificate in a failover cluster instance configuration
63-
64-
1. In SQL Server Configuration Manager, in the console pane, expand **SQL Server Network Configuration**.
65-
66-
2. Right-click **Protocols for** *&lt;instance Name&gt;*, and then choose **Properties**.
63+
## <a id="provision-failover-cluster-cert"></a> Install a certificate in a failover cluster instance configuration
64+
65+
1. In [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] Configuration Manager, in the console pane, expand **SQL Server Network Configuration**.
66+
67+
1. Right-click **Protocols for** *&lt;instance Name&gt;*, and then choose **Properties**.
68+
69+
1. Choose the **Certificate** tab, and then select **Import**.
70+
71+
1. Select the certificate type, and whether to import for the current node only, or for each individual cluster node.
72+
73+
1. If installing for a single node, choose **Browse** and select certificate file. Then skip to step 8.
74+
75+
1. If installing a certificate for each node, select **Next** to list possible owner nodes. Possible owners for the current FCI are preselected.
6776

68-
3. Choose the **Certificate** tab, and then select **Import**.
77+
1. Choose **Next** to select the certificate to be imported.
6978

70-
4. Select the certificate type, and whether to import for the current node only, or for each individual cluster node.
79+
1. Enter the password when prompted. Look for any warnings or errors after validation.
7180

72-
5. If installing for a single node, choose **Browse** and select certificate file. Then skip to step 8.
81+
1. Select **Next** to import the selected certificates.
7382

74-
6. If installing a certificate for each node, select **Next** to list possible owner nodes. Possible owners for the current failover cluster instance are pre-selected.
83+
> [!NOTE]
84+
> Complete these steps in the active node of the FCI. User must have administrator permissions on all the cluster nodes.
7585
76-
7. Choose **Next** to select the certificate to be imported.
86+
## <a id="provision-availability-group-cert"></a> Install a certificate in an availability group configuration
7787

78-
8. Enter the password when prompted. Look for any warnings or errors after validation.
88+
1. In [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] Configuration Manager, in the console pane, expand **SQL Server Network Configuration**.
7989

80-
9. Select **Next** to import the selected certificates.
90+
1. Right-click **Protocols for** *&lt;instance Name&gt;*, and then select **Properties**.
8191

82-
> [!NOTE]
83-
> Complete these steps in the active node of the Always On failover cluster instance. User must have administrator permissions on all the cluster nodes.
92+
1. Choose the **Certificate** tab, and then select **Import**.
8493

85-
## <a name="provision-availability-group-cert"></a>To install a certificate in an Always On Availability Group configuration
86-
87-
1. In SQL Server Configuration Manager, in the console pane, expand **SQL Server Network Configuration**.
88-
89-
2. Right-click **Protocols for** *&lt;instance Name&gt;*, and then select **Properties**.
90-
91-
3. Choose the **Certificate** tab, and then select **Import**.
92-
93-
4. Choose the certificate type and select **Next** to select from the list of known Availability Groups.
94+
1. Choose the certificate type and select **Next** to select from the list of known AGs.
9495

95-
5. Select **Next** to choose certificates for each replica node. Certificates should have a file name that matches the netbios name of the nodes.
96+
1. Select **Next** to choose certificates for each replica node. Certificates should have a file name that matches the netbios name of the nodes.
9697

97-
6. Select **Next** to import the certificate on each node.
98+
1. Select **Next** to import the certificate on each node.
9899

100+
> [!NOTE]
101+
> Complete these steps from the node holding the AG primary replica. User must have administrator permissions on all the cluster nodes.
99102
100-
> [!NOTE]
101-
> Complete these steps from the node holding the Availability Group primary replica. User must have administrator permissions on all the cluster nodes.
103+
## Next steps
102104

105+
- [Certificate requirements for SQL Server](certificate-requirements.md)
106+
- [GRANT Certificate Permissions (Transact-SQL)](../../t-sql/statements/grant-certificate-permissions-transact-sql.md)
107+
- [REVOKE Certificate Permissions (Transact-SQL)](../../t-sql/statements/revoke-certificate-permissions-transact-sql.md)

0 commit comments

Comments
 (0)