Skip to content

Microsoft SQL Server

Tip

Before proceeding, verify that the machine is already created in TLS Protect Cloud. Also, ensure that you’ve completed the prerequisite configuration steps for the Microsoft SQL Server.

  1. In the TLS Protect Cloud toolbar, click Machines.
  2. Click the checkbox next to the Microsoft SQL Server machine that you want to provision a certificate to.
  3. Click Provision a certificate. The Provision a certificate modal opens.

  4. From the Choose a certificate from the inventory field, begin typing the certificate name you want to provision. Click the certificate when you see it listed.

    Verify that you've selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.

  5. From the CAPI Store drop down, select the certificate store you want the certificate installed in.

  6. Enter a Friendly Name for this certificate. The certificate will appear with this name when used in SQL Server.

  7. If you want the private key associated with this certificate to be able to be exported from the Windows certificate store, toggle the Allow private key to be exported option.

  8. (Optional) To automatically provision the certificate to your SQL Server, enable the Installation Endpoint toggle in TLS Protect Cloud.

    Note

    Enabling Installation Endpoint gives you the option to push the certificate to both the Windows certificate store and the SQL Server instance on your server. Leaving this option disabled will only push the certificate to the Windows certificate store.

    1. In the SQL Server instance box, you have the following options:

      • Leave it empty to default to localhost.
      • Use your COMPUTERNAME to apply the certificate to all SQL Server instances.
      • Use your COMPUTERNAME\INSTANCE to apply it to a specific SQL Server instance.

    2. Enable the Restart the SQL server instance toggle to restart the SQL instance automatically. Otherwise, restart it manually before using the certificate.

  9. To create the certificate in TLS Protect Cloud without pushing it, set the Push upon saving slider to No.

    With the default Yes, saving pushes the certificate to the Windows certificate store. If the Installation Endpoint is configured (see previous step), it also pushes the certificate to the SQL Server.

  10. Click Save.

    Want to schedule your provisions?

    Schedule your provisions daily, weekly, or monthly. Learn more

    Are you requiring strict enforcement of PowerShell script signing?

    The Microsoft SQL Server provisioning process uses PowerShell over WinRM to install certificates on the Windows machine. TLS Protect Cloud PowerShell scripts are signed using Venafi's DigiCert CodeSigning certificate. If your organization enforces strict signing requirements to execute PowerShell scripts, ensure Venafi's CodeSigning certificate is included of the Trusted Publishers location on the machine's CAPI store.

    Typically, trusted publisher certificates are managed and distributed via Group Policy by your Active Directory administrators.

    You can find the certificate in PEM format for your convenience here:

    -----BEGIN CERTIFICATE-----
MIIHdjCCBV6gAwIBAgIQDDwkVYKmVAV5QwSzZFlFxTANBgkqhkiG9w0BAQsFADBp
MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT
OERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0
IDIwMjEgQ0ExMB4XDTI0MDgyMTAwMDAwMFoXDTI1MDkxNjIzNTk1OVowfjELMAkG
A1UEBhMCVVMxDTALBgNVBAgTBFV0YWgxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5
MRUwEwYDVQQKEwxWZW5hZmksIEluYy4xGTAXBgNVBAsTEEVuZ2luZWVyaW5nIFZh
YVMxFTATBgNVBAMTDFZlbmFmaSwgSW5jLjCCAiIwDQYJKoZIhvcNAQEBBQADggIP
ADCCAgoCggIBAOfGSJIknBGQ0nZ4KVe1qS/581DkYQcIyAePb1suokp7/YY6h2vg
1OZwdlHHm8aZxb0b1Xq4Pj2h6zf3Egh9rGj/phoUuAaYi4fwxiS67Iy8R66J+kvf
PxlahO1yF5B74/2AuMGOuea230WUb/C8cPDSqb2iNidqqy3z510+IuzG1EU0oZMT
+WFMsqAvD7vuNkFRFaXMrZAwNsAKg898PjT4JH6X4NhZypnSV2gWqjNcF/avpr7H
tbT87xRnzwgyQtKE4+z77hmHrZvyGB335AIrjouf8jHR86sWZWkw/G7b42HV1Uyb
GUdZTWM6l3hNQV6i0eUNqPNz5rQXkZGyit5PPSJRxnAI0lec0gGGnIJlkc7WeTY8
5+M0Pqd6RtomlOra7euGR4/w93H073E9EdhBL5mpjF7jkB/sWGgZgYiVeeFE9Ecc
kSOBtwb+2HoZkg87OBQ6NzXxHyksX0MY9N6XKqQdbtIwTOSjZfils/S8YP/hhkWV
MEFKIqjQEsL9jH30MpG9bEjCvhO9R4R5E5uQjmTqwQWg5uDQopkmSm0iC2WCWcv1
dhvMb294vNhw578jEKowyNH5VNwNeuTCpdzMNfdHTY1loorltbIa1dEN1xOjm4ve
a0JijE+1OvlbPBMWhcB8JnkjFdNYUc1swErV8MvZxv1zns9U8E594/bXAgMBAAGj
ggIDMIIB/zAfBgNVHSMEGDAWgBRoN+Drtjv4XxGG+/5hewiIZfROQjAdBgNVHQ4E
FgQUMqZQnX+ejPhr/xdSp/xnOUTkyf0wPgYDVR0gBDcwNTAzBgZngQwBBAEwKTAn
BggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA4GA1UdDwEB
/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBP
hk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2Rl
U2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2Ny
bDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0
MDk2U0hBMzg0MjAyMUNBMS5jcmwwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUF
BzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6
Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWdu
aW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcN
AQELBQADggIBALfd+IlW7Ucv0KtHZM6AYYIRAJGFqiyBq5l00SeGxhD7HY4LhNeO
MOwxx7ZIYk7A/vPtMUHBtB6m162QM3RFZOdU6vnp/aKBKOzG4BUYM9oyh3d7w9y0
vMgENlvl5ITlz7slvbZG9olQTwIS/tNQCdYu3UGgTpFcQma1Inrlma7+RHec0XWo
DYFgm3Vxw+9zv71Hio0KGpwXfZGQtYxiGeU9ftfebHZ40uxRIvzIIQ3Na1HZTsWx
2GziDljY+cMaU1bibC76RHIQ/exUO18xDnTd5gjc+Kdreo9iJWzQgEBB/X5IzjmC
gD+zKpHd+4wGV4y2DyWXr9YzP045N6qtv4vftnr0EWH9UNErlPhqMpRUO3oEf49s
fXmnBRhYeESbLnGm1+sy1HCRjKo3ExpLO/UButtg67bqq1cHei/ru7ijF8jxOYvm
Nsgxis2bkWugnxIgfYjvjsLgiYFSbQVP19LtsuNeWp7alfSCfLazoPnk2lsByHNB
Q5JjZjnmOET1AafDaKI2roay0U/RIFiYanA0bxZxM3lmsXGPbSOEWQUFArlltMAp
HYuZMQswEfNXUkj/SaTDMj5YNDN4DCqIchV/C2pkRN8NzQRDUm/f1zkO4z11YENF
OQ7vam82kVOEWSevAXeYGrS4/VR02CujvRnJr0mBduSmQJrz5JvacdUK
-----END CERTIFICATE-----