Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

New-SqlCertRequest

Generates a SAN certificate signing request (CSR) for SQL connection encryption — the first step, done to spec so the issued cert actually works with SQL S...

Domain: SQL Database Engine · Risk: Changes state (writes a request + private key) · Runs on: Windows, PowerShell 5.1 or 7

Before a certificate authority can issue a certificate, it needs a request that states the server name and the technical properties SQL Server requires. Getting those properties wrong is the usual reason a freshly issued cert refuses to bind. This command writes a correct request every time, so the cert you get back is one SQL Server can use.

It changes nothing on SQL Server itself — it produces a request file (and the matching private key) on the machine. It is the opening move of provisioning, not the risky part.

Writes an INF (Server Authentication EKU, Digital Signature + Key Encipherment, RSA-2048/SHA256, CNG “Microsoft Software Key Storage Provider”, exportable) and runs certreq -new. Returns a SqlCert.Result with the .inf and .req paths. Under -WhatIf nothing is written and Status is Skipped. Never throws.

Modern clients require a SAN — always supply -DnsName, or it defaults to the CN.

Recipe 01 — Request for one FQDN plus its short name

New-SqlCertRequest -CommonName 'sql01.example.com' -DnsName 'sql01.example.com','sql01'

Writes request.inf / request.req; hand the .req to Submit-SqlCertRequest.

Recipe 02 — Put the artifacts in a specific scratch folder

New-SqlCertRequest -CommonName 'sql01.example.com' -WorkPath 'D:\certreq\sql01'

Keeps the .inf/.req where your change record expects them.

Recipe 03 — Preview without writing anything

New-SqlCertRequest -CommonName 'sql01.example.com' -WhatIf

Status = Skipped; nothing is written — useful in a dry run.

A “certificate signing request” (CSR) is a small file that says: here is the server name I want a certificate for, and here are its technical settings. You send it to a certificate authority, which signs it and hands back the real certificate.

The technical settings matter. SQL Server insists a connection certificate be marked for “Server Authentication” and use a key it can read. This command fills all of that in for you, so you don’t have to know the settings by heart.

Question Answer
Outbound calls? None. It writes local files and generates a keypair on the machine.
What it produces An .inf, a .req (the request), and a private key in the machine key store.
Privileges Local admin (writes to the machine key store).
Licence Part of the provisioning (paid) path. Read-only audit commands remain free.
Dependency Why Required?
Windows + PowerShell 5.1 or 7 Runs certreq and writes the request. Yes
certreq.exe (in-box on Windows) Generates the CSR and key. Yes (present by default)
A writable scratch path Holds the .inf/.req. Yes
  • The request pins RSA-2048 / SHA-256 and the Server Authentication purpose — no weak-key or wrong-purpose certs enter the flow.
  • The key is generated in the machine key store, not exported to disk in the clear.
  • Under -WhatIf the command is a no-op, so a change-controlled environment can preview it safely.