Microsoft SQL Server¶

1. In the Certificate Manager - SaaS toolbar, click Machines.
2. Click the more options button at the right end of the Microsoft SQL Server machine's row, and then select Provision. The Provision a certificate modal opens.

3. From the Choose a certificate from the inventory field, begin typing the certificate name you want to provision. Click the certificate when you see it listed.

   Verify that you've selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.

4. From the CAPI Store drop down, select the certificate store you want the certificate installed in.

5. Enter a Friendly Name for this certificate. The certificate will appear with this name when used in SQL Server.

6. If you want the private key associated with this certificate to be able to be exported from the Windows certificate store, toggle the Allow private key to be exported option.

7. (Optional) To automatically provision the certificate to your SQL Server, enable the Installation Endpoint toggle in Certificate Manager - SaaS.

   Note

   Enabling Installation Endpoint gives you the option to push the certificate to both the Windows certificate store and the SQL Server instance on your server. Leaving this option disabled will only push the certificate to the Windows certificate store.

   1. In the SQL Server instance box, you have the following options:

      • Leave it empty to default to localhost.
      • Use your COMPUTERNAME to apply the certificate to all SQL Server instances.
      • Use your COMPUTERNAME\INSTANCE to apply it to a specific SQL Server instance.

   2. Enable the Restart the SQL server instance toggle to restart the SQL instance automatically. Otherwise, restart it manually before using the certificate.

8. To create the certificate in Certificate Manager - SaaS without pushing it, set the Push upon saving slider to No.

   With the default Yes, saving pushes the certificate to the Windows certificate store. If the Installation Endpoint is configured (see previous step), it also pushes the certificate to the SQL Server.

9. Click Save.

   Want to schedule your provisions?

   Schedule your provisions daily, weekly, or monthly. Learn more

   Are you requiring strict enforcement of PowerShell script signing?

   The Microsoft SQL Server provisioning process uses PowerShell over WinRM to install certificates on the Windows machine. Certificate Manager - SaaS PowerShell scripts are signed using Venafi's DigiCert CodeSigning certificate. If your organization enforces strict signing requirements to execute PowerShell scripts, ensure Venafi's CodeSigning certificate is included of the Trusted Publishers location on the machine's CAPI store.

   Typically, trusted publisher certificates are managed and distributed via Group Policy by your Active Directory administrators.

   You can find the certificate in PEM format for your convenience here:

   -----BEGIN CERTIFICATE-----
   MIIHkjCCBXqgAwIBAgIQBgA2T7ITSsnbtRYegJ4l6DANBgkqhkiG9w0BAQsFADBp
   MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT
   OERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0
   IDIwMjEgQ0ExMB4XDTI2MDkyNDAwMDAwMFoXDTI3MDkyMzIzNTk1OVowgZkxCzAJ
   BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQHEwtTYW50YSBD
   bGFyYTEhMB8GA1UEChMYUGFsbyBBbHRvIE5ldHdvcmtzLCBJbmMuMRkwFwYDVQQL
   ExBFbmdpbmVlcmluZyBWYWFTMSEwHwYDVQQDExhQYWxvIEFsdG8gTmV0d29ya3Ms
   IEluYy4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXEoMfbTbxsvVa
   m0u6eml6k/yHeA9r0yUamSW0LSOUuLzGpuq0lvuzolkMYGRqlPFXDDdOKali4HyH
   sq/xTll1UqUXfETXD/c3OMcZHStIwaWAlo5KhvffZs9qHvZ5WHB0gSoDJjUY7nM2
   TgAG6T+9xAdUFRVREMzgjFLV3LoILx4LCDhQwQndk+dMY8ngrkrE//N/G2ad15kn
   G6MEIsOTORUqXMs/9LTEkr65tUamAFOPkszlcnAQ1xmRzkCSFxw4N2LVSCWIxmrZ
   0im9/pVTXwR4XaG7R1QyzIX/wMN/cYrglJgOVt+6IbIG/S68NGZH9g5LYL2EcTP4
   Ki/3x3zEEi8UJ6IJ82tfv5e/Yr7hFg9Exzaau6rmIylr+IrjIcT0SJPX95FOEozv
   TV2lP459Wsk3mQg0M0KLF0W9EL6SwDfh+oWuejfGDAtq5TKDV/qDodECZr/8hgE5
   e0m0LajxHAT0aROSnjU4moqaN6EUKKHbCvCwMuirJKWsGx0/0D613gUywt6cEG0z
   69pJFwm3T0tAa7vUkYjD5j1UFqIy965Co7s0stexvhfQLqnsSIEYfmcAzmj94pvm
   oE/IXpCr6in91kvTv7Wvx+ZwxKX+IVMJvgQuoKw4NDBjOWNXUfZQBznrpILus8o+
   ONK1cEpXh2jAtgDdSTS+KWIEMobyEwIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAU
   aDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFK24lFT/8MnwqCz4ol4xBO0N
   lfv9MD4GA1UdIAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93
   d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYI
   KwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNl
   cnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0
   MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdp
   Q2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3Js
   MIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGln
   aWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5j
   b20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIx
   Q0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQAgLKMeHbYCDN1S
   PJELMA/8BPtutmNup27jrc/5n9BGoXdrD6gJgKXJVYYsAVZpe+S3V0XDqi5N5PgR
   lw74Jr5IbPSQfrgWgL9hkMzBMoIT4R9YsAQ0lQFREgexuZhVnZXViWc7WwpSBs62
   1j+kE3E7zhCFiibnXvMjgVuAXls6SlikGuvdD/Pex7ZECz3IsS7Pf6CbqYbznTTf
   9dXIKGPyMoZDLGmedDvCQWeubqS1k9lUIv06knKZw6EY/LXENSb15kzrkF6/MfHE
   aGDpxUsLGL8DIK0kAjl2brwBWrhdVc6OPJp4SZXqjm9+/ZhC6dQQclVTb29BToug
   nN3IRBXtqHdXDkj0IEUYVuwLCx9P1IpMqOoXsDZp+CwCi6jy6jIflWpDv/5NRnZs
   iXKTbddsJLlrO21uNJusmhZcKFkq0prIoFuL6/yImG8DJ/UQGxISoGpfeURHI9JA
   V64jCRaJuydeeVENS6wm429WfgQ/fARxFg7YPRTwbHwurGQzHT/03Z2eiNgRnoi2
   xmApiycAIEu1bOdBGYZ9nUHRuoVRnESYAiNCqW3c7DqIIRpPAoCSYsBx8mPWknX8
   nXJHUFzFKDNH/j86tS43wmCgKPDW+zdarepfEmrg+lpUE3OhIHBnrB0qRxEU4N0Y
   fX7EDfCAv7velGAWDsLxrAPmCcoGhA==
   -----END CERTIFICATE-----