Domain: Client trust · Risk: Changes state · Runs on: Windows, PowerShell 5.1 or 7

Audience Lens

Manager Practitioner Learner

This is the client half of an encrypted connection. A server can present a certificate, but a client only accepts it if it already trusts the issuer that signed it. This command adds that trust anchor to a client — or, run across a list, to a whole fleet.

It only ever adds; it never removes a trust anchor. If the client already trusts the issuer, it does nothing and reports Skipped, so it’s safe to run repeatedly, and you can preview it with -WhatIf first.

Reads the issuer/root .cer you supply on the caller and pushes its bytes into the target’s LocalMachine\Root, so the file need not exist on every client. Idempotent — already trusted returns Skipped. Add-only: it never removes an anchor, because removing one can silently break unrelated services. The state change runs under ShouldProcess (so -WhatIf is supported). Never throws.

Recipe 01 — Trust the Corp Root CA on one client

Add-SqlCertClientTrust -CertificatePath .\CorpRootCA.cer -ComputerName app07

Imports the Corp Root CA into app07’s trusted-root store so it trusts SQL/RS certificates that CA issued. Returns Skipped if app07 already trusts it.

Recipe 02 — Preview across a fleet

$clients | ForEach-Object { Add-SqlCertClientTrust -CertificatePath .\CorpRootCA.cer -ComputerName $_ -WhatIf }

Shows exactly which machines would receive the trust anchor, without changing anything.

Watchpoint — add only, never remove. The command will not remove a trust anchor, by design. Retiring an old or unwanted anchor is a separate, deliberate step you do by hand — removing one can silently break services that still depend on it.

TLS trust runs in a chain: a server’s certificate is signed by an issuer (a certificate authority), and a client accepts the server’s certificate only if it already trusts that issuer.

This command puts the issuer’s certificate into the client’s trusted-root store. With that anchor in place, the chain checks out and the encrypted connection to the SQL Server or Reporting Services endpoint can succeed.

Software Approval Dependencies Compliance

Question	Answer
Outbound calls?	Reads the `.cer` on the caller; writes to the certificate store on the target (local, or `-ComputerName` over WinRM). No other calls.
What it changes	Adds one certificate to `LocalMachine\Root` on the target. It never removes one.
Privileges	Local admin on the target (`LocalMachine\Root` is machine-wide); a credential or WinRM for a remote import.
Reversibility	Additive — it only adds. To reverse, remove the imported certificate from `LocalMachine\Root` on the target yourself.

Dependency	Why	Required?
Windows + PowerShell 5.1 or 7	Reads the `.cer` and writes the store.	Yes
The issuer/root `.cer` file, reachable from the caller	The bytes it distributes.	Yes
A credential or WinRM to the target	Only for a remote `-ComputerName` import.	No (local)

Add-only by design — it never removes a trust anchor, so it can’t silently break an unrelated service.
Idempotent: an already-trusted issuer returns Skipped, so fleet-wide re-runs are safe.
The state change is previewable with -WhatIf and recorded in the result (Thumbprint, Subject, NotAfter, ComputerName).