Register-SqlCertRenewalJob

An expired TLS certificate is an outage that arrives on a schedule you didn’t choose. This command removes that risk: it sets up a job that watches a certificate and renews it before it lapses, without anyone remembering to. You set it up once per certificate; it runs itself thereafter.

Three things to know before you approve its use:

1. It fits your existing scheduler. Whether your team lives in Windows Task Scheduler, cron, or SQL Server Agent, the job runs there — no new scheduling system to adopt.
2. It runs under an identity you control. The recommended setup is a managed service account (gMSA) that already holds the needed rights, so no password is stored anywhere.
3. A failed renewal never causes an outage. The job proves the new certificate works before it replaces the old one; if anything fails, the working certificate stays in place.

Writes a spec (%ProgramData%\SqlCertForge\renewals\<JobId>.json — no plaintext secret; a PFX password is a reference) and creates a schedule entry in the chosen backend. Two certificate sources — a CA (Request/Submit) or a supplied PFX — selected by parameter set. The scheduled runner (Invoke-SqlCertRenewalJob) does the work; the entry just triggers it.

Recipe 01 — SQL engine, CA-issued, Task Scheduler, under a gMSA

Register-SqlCertRenewalJob -JobId sql01-engine -CertType SqlConnection `
    -CaConfig 'CA01\Corp Issuing CA' -CertificateTemplate WebServer -CommonName sql01.corp.com `
    -SqlInstance MSSQLSERVER -ServiceAccount 'NT SERVICE\MSSQLSERVER' -RunAsUser 'CORP\gmsa_scf$'

Renews within 30 days of expiry (default), no stored secret.

Recipe 02 — PBIRS scale-out, PFX source, on SQL Server Agent

Register-SqlCertRenewalJob -JobId reports-pbirs -CertType Pbirs `
    -PfxPath \\share\reports.pfx -PfxPasswordRef ReportsPfxPwd `
    -VanityUrl reports.example.com -Node n1,n2 -Scheduler SqlAgent -SqlInstance RPT01

-PfxPasswordRef names a SecretManagement secret — the password itself is never in the spec.

Recipe 03 — Tighter threshold, SSRS, on cron

Register-SqlCertRenewalJob -JobId ssrs-portal -CertType Ssrs -ThresholdDays 45 `
    -PfxPath /certs/ssrs.pfx -PfxPasswordRef SsrsPfxPwd `
    -VanityUrl reports.example.com -RsInstance SSRS -Scheduler Cron

Watchpoint — the run-as identity needs the rights. The scheduled runner acts with no human present, so the account it runs as (-RunAsUser, ideally a gMSA) must hold CA-enrolment / local-admin / the service-account knowledge. If a backend’s tooling isn’t on the host, the command returns the schedule entry text to apply by hand rather than failing silently.

A “renewal job” is a saved note that says: this certificate, on these servers, renew it when it’s within N days of expiring, from this source. This command writes that note and tells your scheduler to check it on a cadence.

You don’t have to know the internals of Task Scheduler, cron, or SQL Agent — you pick one with -Scheduler, and the command sets up the entry. From then on, the certificate renews itself before it expires.

• No plaintext secret is persisted — the spec is safe to read; a PFX password is a vault reference.
• The renewal never replaces a working certificate until the new one verifies (safe-swap), so automation can’t cause a silent outage.
• Every scheduled run appends a structured outcome to the run log — an audit trail of what renewed, when, and whether it succeeded.