Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Test-SqlCertBinding

Reports the certificate binding SQL Server will use — bound thumbprint, Force Encryption state, and expiry — across one or many nodes. Read-only, and free.

Domain: SQL Database Engine · Risk: Read-only · Runs on: Windows, PowerShell 5.1 or 7

This is the check that answers “is this server actually set up to encrypt, and with a certificate that hasn’t expired?” — without changing anything. It’s part of the free, read-only tier, so a team can inventory every SQL Server’s TLS state at no cost before deciding what to fix.

Reads the SuperSocketNetLib registry key for each instance and returns the bound thumbprint, the ForceEncryption flag, and certificate expiry. This reflects what SQL Server will use on the next restart. Returns Failed if the bound certificate has expired (SQL rejects an expired cert on restart). Never throws.

For proof the running instance loaded the cert, check the SQL error log for “successfully loaded for encryption” — the registry value is intent; the error log is fact.

Recipe 01 — Check the default instance

Test-SqlCertBinding -SqlInstance 'MSSQLSERVER'

Recipe 02 — Check the same instance across cluster nodes

Test-SqlCertBinding -SqlInstance 'MSSQLSERVER' -Node 'NODE1','NODE2'

One call returns a row per node — useful for confirming a cluster is consistent.

Recipe 03 — A remote node with explicit credentials

Test-SqlCertBinding -SqlInstance 'MSSQLSERVER' -Node 'SQL-DMZ01' -Credential $cred

This command looks but never touches. It reads the setting that tells you which certificate SQL Server is configured to use, whether it’s set to require encryption, and when that certificate expires.

It’s the safe first thing to run: on a server you’re not sure about, this tells you where you stand before you change anything. If it reports an expired certificate, that’s a Failed result — a heads-up that a restart would break encryption.

Question Answer
Outbound calls? None. Registry reads on the local (or named) machines.
What it changes Nothing — read-only.
Privileges Read access to the instance registry; WinRM for remote nodes.
Licence Free. Read-only audit commands need no licence.
Dependency Why Required?
Windows + PowerShell 5.1 or 7 Reads the registry and cert store. Yes
WinRM to remote nodes Only for remote -Node reads. No (local)
  • A safe, non-mutating way to inventory TLS posture across an estate — ideal for a compliance sweep.
  • Flags an expired bound certificate as a Failed result, surfacing a latent outage before it happens.
  • Returns per-node/per-instance rows (InstanceName, Thumbprint, ForceEncryption, ExpiresOn, IsExpired, Node) — structured evidence for an audit record, no licence required to produce it.