Domain: SQL Database Engine · Risk: Changes state · Runs on: Windows, PowerShell 5.1 or 7

Audience Lens

Manager Practitioner Learner

This is the step that turns a request into an actual certificate by asking your certificate authority to sign it. Two outcomes are normal: the CA issues immediately, or it queues the request for a human to approve. Both are handled — a queued request is reported as Pending, not an error, and can be picked up later. Nobody has to sit and watch it.

Runs certreq -submit. If the CA auto-issues, the cert is accepted and Status is Success with a node-independent thumbprint. If the CA holds the request, Status is Pending and the result carries the RequestId plus the exact retrieve command. Never throws.

-CaConfig is the CA configuration string (CAHost\CA Common Name), not the /certsrv URL — certutil -dump shows it.

Recipe 01 — Submit a request to an issuing CA

Submit-SqlCertRequest -CaConfig 'CA01\Example Issuing CA' `
    -RequestPath C:\certreq\sql01\request.req -CertificateTemplate WebServer

Success returns the issued thumbprint; Pending returns the RequestId and the retrieve command.

Recipe 02 — Choose where the issued .cer lands

Submit-SqlCertRequest -CaConfig 'CA01\Example Issuing CA' `
    -RequestPath C:\certreq\sql01\request.req -CertificateTemplate WebServer `
    -OutPath D:\certs\sql01.cer

Writes the issued certificate to a known path for your records.

A certificate authority (CA) is the trusted party that signs certificates. Submitting is handing your request to it and getting the signed certificate back.

Sometimes the CA issues right away. Sometimes an administrator has to approve it first — in that case you get a Pending result with a request number. That’s not a failure; it means “waiting for approval.” Once approved, the same flow retrieves the finished certificate.

Software Approval Dependencies Compliance

Question	Answer
Outbound calls?	To your own AD CS certificate authority, inside your network. Never to the vendor.
What it produces	The issued `.cer`, accepted into the machine store.
Privileges	Enrolment rights on the chosen CA template; local admin on the machine.
Licence	Part of the provisioning (paid) path.

Dependency	Why	Required?
An AD CS certificate authority	Signs the request.	Yes
A `.req` from `New-SqlCertRequest`	The thing being submitted.	Yes
Enrolment rights on the template	The CA rejects submissions without them.	Yes

The certificate is obtained from your enterprise CA under a template you control — issuance policy stays in your hands.
A Pending result is surfaced honestly rather than being retried into a silent failure; the approval step remains a real, auditable gate.
The accepted thumbprint is returned for the record and threaded forward so later steps bind the exact certificate that was issued.