Detent PointDomain: Endpoint authentication · Risk: Read-only · Runs on: Windows, PowerShell 5.1 or 7
This answers “is this replica’s data endpoint set up to authenticate by certificate, and with which one?” without changing anything. It’s the check to run before wiring up certificate trust between two servers, and again afterward to confirm it took.
Reads the endpoint metadata — the mirroring or Service Broker endpoint joined to sys.endpoints, left-joined to master.sys.certificates — and reports whether it exists, its state, whether it authenticates by certificate, and the certificate name, thumbprint, and expiry. The endpoint view is chosen from a ValidateSet, not caller free-text. An absent endpoint is reported as a Success, not an error. Never throws.
Recipe 01 — Check the mirroring / AG endpoint
Test-SqlEndpointCertAuth -SqlInstance node1Recipe 02 — The Service Broker endpoint
Test-SqlEndpointCertAuth -SqlInstance node1 -EndpointType ServiceBrokerThe default is DatabaseMirroring, which also covers Always On availability group endpoints.
Watchpoint — no endpoint is a Success, not a failure. When the instance has no endpoint of that type, the result is a Success reporting the absence (EndpointExists = $false). Check that field rather than reading a non-failure as “configured.”
Two servers that mirror or run an availability group connect over an endpoint, and that endpoint can be told to authenticate by certificate. This command looks at one server and reports what it finds: whether the endpoint exists, whether it’s using certificate authentication, and if so which certificate — including when that certificate expires.
It only reads. It’s the safe thing to run first to see where a server stands before you change anything.
| Question | Answer |
|---|---|
| Outbound calls? | It connects to the SQL instance you name (via the dbatools/SqlServer provider) to read the endpoint and certificate catalog views. No other outbound calls. |
| What it changes | Nothing — read-only. |
| Privileges | A login that can read the endpoint and certificate catalog views (e.g. VIEW ANY DEFINITION). |
| Licence | Free. Read-only audit commands need no licence. |
| Dependency | Why | Required? |
|---|---|---|
| A reachable SQL instance (dbatools/SqlServer) | The catalog views are read there. | Yes |
| Windows + PowerShell 5.1 or 7 | Runs the read. | Yes |
- Read-only — inventory endpoint certificate authentication across replicas without changing anything.
- Reports the certificate name, thumbprint, and expiry when the endpoint is certificate-authenticated, giving a dated record for an audit.
- The endpoint view is selected from a fixed set, not caller free-text, so the read carries no injection surface.