Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Import-SqlCert

Imports a .pfx into the machine certificate store on one or more nodes — with every node agreeing on the same thumbprint by construction.

Domain: SQL Database Engine · Risk: Changes state · Runs on: Windows, PowerShell 5.1 or 7

When you buy a certificate from an external provider (or export one you already hold), it arrives as a password-protected .pfx file. This command installs it onto the servers that need it. For a cluster, it installs the same certificate on every node, so a failover never lands on a server missing the cert.

Uses native Import-PfxCertificate on the local node, or ships the PFX bytes over a PSSession and imports on the remote node. The thumbprint is read from the PFX file itself, so every node agrees by construction. Never throws.

Recipe 01 — Import to the local machine

Import-SqlCert -PfxPath C:\certs\sql01.pfx -PfxPassword $pw

Recipe 02 — Import the same cert to every cluster node at once

Import-SqlCert -PfxPath C:\certs\sql.pfx -PfxPassword $pw -Node SQLNODE01,SQLNODE02

Both nodes end up with the identical thumbprint — the point of reading it from the PFX.

Recipe 03 — A workgroup or cross-domain node

$cred = Get-Credential
Import-SqlCert -PfxPath \\share\sql.pfx -PfxPassword $pw -Node SQL-DMZ01 -Credential $cred

Kerberos pass-through doesn’t apply off-domain, so supply a credential.

A .pfx file is a certificate together with its private key, wrapped in a password. Importing it puts the certificate into the server’s store where SQL Server can find it.

The useful detail: this command reads the certificate’s fingerprint (its “thumbprint”) straight out of the file. That means when you import to several servers, they all reference the exact same certificate — no drift, no “which one did node 2 get?”

Question Answer
Outbound calls? None. Local import, or a direct PSSession to the servers you name.
What it produces The certificate installed in LocalMachine\My on each node.
Privileges Local admin on each target; WinRM for remote nodes.
Handling of the PFX password Taken as a SecureString; not written to disk or logged.
Dependency Why Required?
Windows + PowerShell 5.1 or 7 Runs the import. Yes
The .pfx and its password The certificate being installed. Yes
WinRM to remote nodes Only when importing to a remote -Node. No (local)
  • The PFX password is handled as a SecureString end to end.
  • The installed thumbprint is returned, giving a record of exactly which certificate landed on which node.
  • Multi-node imports are provably consistent — the thumbprint comes from the file, not from re-reading each node, so an auditor can confirm every node holds the same certificate.