Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Export-SqlEndpointCertificate

Exports the public half of an endpoint certificate to a file, to hand to a partner replica. It never exports the private key — there is no parameter that c...

Domain: Endpoint authentication · Risk: Changes state · Runs on: Windows, PowerShell 5.1 or 7

When two servers authenticate to each other by certificate, each needs the other’s public certificate. This command writes one server’s public certificate to a file you can copy to the partner. It’s the public half only — the private key stays on the server, and there’s no option to include it — so the file is safe to move between machines.

Runs BACKUP CERTIFICATE ... TO FILE with no WITH PRIVATE KEY clause, so only the public certificate is written. Confirms the certificate exists first (a clear Failed if not). This is the structural opposite of Backup-SqlTdeCertificate, which escrows the certificate with its private key; this command has no -Password or -PrivateKeyPath, so a private key can’t be exported through it. IncludesPrivateKey on the result is always $false. Supports -WhatIf; never throws.

Recipe 01 — Export a public endpoint certificate

Export-SqlEndpointCertificate -SqlInstance node1 -Name 'Node1_Endpoint_Cert' -Path 'E:\exchange\node1.cer'

Writes node1’s public certificate for node2 to import.

Recipe 02 — Preview without writing

Export-SqlEndpointCertificate -SqlInstance node1 -Name 'Node1_Endpoint_Cert' -Path 'E:\exchange\node1.cer' -WhatIf

Watchpoint — the path is on the SQL Server’s file system. BACKUP CERTIFICATE ... TO FILE runs inside SQL Server, so -Path is a path on the target instance’s machine — and must be writable by the SQL Server service account — not on the workstation running the command.

A certificate has two halves: a private key the server keeps secret, and a public certificate anyone can hold. To let a partner server verify this one, the partner only needs the public half. This command writes that public half to a file.

It never writes the private key — there’s no way to ask it to — so you can copy the file to the other server without handing over anything secret. The partner then imports it with Grant-SqlEndpointCertAccess.

Question Answer
Outbound calls? It connects to the SQL instance you name (via the dbatools/SqlServer provider); SQL Server writes the .cer to the -Path you give on that server. No other outbound calls.
What it changes Writes one file — the public certificate. It creates no database objects and doesn’t alter the certificate.
Privileges A SQL login permitted to back up the certificate in master (e.g. CONTROL on the certificate); the SQL Server service account needs write access to the path.
Reversibility Delete the file. It holds only the public certificate, so there is no private key in it to protect.
Dependency Why Required?
The named certificate present in master It’s the certificate being exported; absent → Failed. Yes
A path writable by the SQL Server service account BACKUP CERTIFICATE TO FILE writes there. Yes
Grant-SqlEndpointCertAccess on the partner Imports the exported public certificate and grants it access. To go live
  • Public certificate only — there is no -Password or -PrivateKeyPath, so the command can’t export a private key even by mistake.
  • IncludesPrivateKey is always $false on the result, an explicit record that no private key left the server.
  • Confirms the certificate exists before writing anything, returning a clear Failed rather than an empty or partial file.
  • -WhatIf previews the export without creating the file.