Skip to content

Clarify private key permissions in Set-DbaNetworkCertificate help #10586

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
andreasjordan wants to merge 1 commit into
base: development
Choose a base branch
from
+9 −3
Open

Clarify private key permissions in Set-DbaNetworkCertificate help #10586

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions public/Set-DbaNetworkCertificate.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,12 @@ function Set-DbaNetworkCertificate {
If the given certificate is not returned as a suitable certificate, the command gets detailed information
about why the given certificate is not suitable and fails with that information.

This command also grants read permissions for the service account on the certificate's private key.
This command also grants read permissions on the certificate's private key
to the per-service SID of the instance (NT SERVICE\MSSQLSERVER for the default
instance, NT SERVICE\MSSQL$<InstanceName> for named instances). The service SID
is always part of the process token of the SQL Server service, so the permission
is effective regardless of the account the service runs as, and it does not have
to be changed when that account changes.

The currently configured certificate can be unset by using the parameter -UnsetCertificate.

Expand All @@ -43,8 +48,9 @@ function Set-DbaNetworkCertificate {
.PARAMETER Thumbprint
Specifies the thumbprint (SHA-1 hash) of the certificate to configure as the network certificate.
Use this when you know the specific certificate thumbprint from certificates already installed in LocalMachine\My.
Must be a 40-character hexadecimal string (no spaces). The certificate must have a private key and the SQL Server
service account will be granted read permissions to it.
Must be a 40-character hexadecimal string (no spaces). The certificate must have a private key.
Read permissions on the private key are granted to the per-service SID of the
instance (see the description above).

.PARAMETER UnsetCertificate
Unsets the currently configured network certificate for the SQL Server instance.
Expand Down