From 4983695db431b5d46132ba8ae05c04df481153d7 Mon Sep 17 00:00:00 2001 From: Andreas Jordan Date: Wed, 19 Aug 2026 15:05:44 +0200 Subject: [PATCH] Set-DbaNetworkCertificate - Clarify who gets read permissions on the private key The help said the command grants read permissions "for the service account", but the code grants them to the per-service SID of the instance (NT SERVICE\MSSQLSERVER, or NT SERVICE\MSSQL$ for named instances). Readers assumed the startname of the service was used, which caused confusion in the issue. Documentation only - no code changed. The .OUTPUTS ServiceAccount property still documents the startname reported by WMI, which is correct as written. Refs #10125 (do Set-DbaNetworkCertificate) Co-Authored-By: Claude Opus 5 (1M context) --- public/Set-DbaNetworkCertificate.ps1 | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/public/Set-DbaNetworkCertificate.ps1 b/public/Set-DbaNetworkCertificate.ps1 index 1f825e1f3b1..c84dfdcfa71 100644 --- a/public/Set-DbaNetworkCertificate.ps1 +++ b/public/Set-DbaNetworkCertificate.ps1 @@ -19,7 +19,12 @@ function Set-DbaNetworkCertificate { If the given certificate is not returned as a suitable certificate, the command gets detailed information about why the given certificate is not suitable and fails with that information. - This command also grants read permissions for the service account on the certificate's private key. + This command also grants read permissions on the certificate's private key + to the per-service SID of the instance (NT SERVICE\MSSQLSERVER for the default + instance, NT SERVICE\MSSQL$ for named instances). The service SID + is always part of the process token of the SQL Server service, so the permission + is effective regardless of the account the service runs as, and it does not have + to be changed when that account changes. The currently configured certificate can be unset by using the parameter -UnsetCertificate. @@ -43,8 +48,9 @@ function Set-DbaNetworkCertificate { .PARAMETER Thumbprint Specifies the thumbprint (SHA-1 hash) of the certificate to configure as the network certificate. Use this when you know the specific certificate thumbprint from certificates already installed in LocalMachine\My. - Must be a 40-character hexadecimal string (no spaces). The certificate must have a private key and the SQL Server - service account will be granted read permissions to it. + Must be a 40-character hexadecimal string (no spaces). The certificate must have a private key. + Read permissions on the private key are granted to the per-service SID of the + instance (see the description above). .PARAMETER UnsetCertificate Unsets the currently configured network certificate for the SQL Server instance.