Detent Point

SqlCertForge TLS certificate binding for SQL Server and Reporting Services

Test-SqlPolyBaseCertificate

Reports what is verifiable about a SQL instance's PolyBase TLS surface — whether PolyBase is installed, its scale-out compute nodes, and (optionally) the c...

Domain: PolyBase · Risk: Read-only · Runs on: Windows, PowerShell 5.1 or 7

This answers “is PolyBase installed on this server, what are its compute nodes, and — if you point it at the engine port — which certificate is bound there?” without changing anything.

It reports; it does not manage PolyBase’s own internal certificates. Those are managed by PolyBase and aren’t documented as something you script, so this command sticks to facts it can verify and leaves them alone.

Reads SERVERPROPERTY('IsPolyBaseInstalled'); if installed, the scale-out compute nodes from sys.dm_exec_compute_nodes; and, when you supply -IPPort, the certificate bound to that HTTP.sys port (reusing the module’s HTTP.sys read seam), with its subject and expiry. Documented, verifiable sources only — no fabricated queries against PolyBase internals. Never throws.

Recipe 01 — Is PolyBase installed, and what are its nodes?

Test-SqlPolyBaseCertificate -SqlInstance sql01

Reports whether PolyBase is installed on sql01 and the compute nodes in its scale-out group.

Recipe 02 — Also check the engine port’s certificate

Test-SqlPolyBaseCertificate -SqlInstance sql01 -IPPort '0.0.0.0:16450'

Additionally reports the certificate bound to the PolyBase engine HTTP.sys port. The engine-port check reads the HTTP.sys binding and certificate store on the local machine, so run it on the PolyBase engine host.

Watchpoint — it reports, it doesn’t manage. PolyBase’s internal scale-out-group certificates are PolyBase-managed and not documented as externally scriptable. This command reports what’s verifiable — installed state, compute nodes, and the engine-port binding you name — and does not bind, rotate, or manage anything.

PolyBase spreads a query across a scale-out group of compute nodes, and its engine exposes an HTTP endpoint.

This command reports the facts you can verify from SQL Server and Windows: whether PolyBase is turned on, which nodes are in the group, and — if you name the engine port — which certificate secures it, with its expiry. It doesn’t touch PolyBase’s own internal certificates.

Question Answer
Outbound calls? Connects to the SQL instance you name for the two PolyBase queries (the module’s SqlServer / dbatools provider); when -IPPort is given, reads the HTTP.sys binding and certificate store on the local machine. No other calls.
What it changes Nothing — read-only.
Privileges Rights to run the two queries on the instance; read access to the local HTTP.sys binding and certificate store for -IPPort.
Licence Free. Read-only audit commands need no licence.
Dependency Why Required?
Windows + PowerShell 5.1 or 7 Runs the queries and the port read. Yes
A SQL connection to the instance (the module’s SqlServer / dbatools provider) Reads IsPolyBaseInstalled and the compute nodes. Yes
Run on the PolyBase engine host The -IPPort check reads the local HTTP.sys binding and certificate store. Only for -IPPort
  • Read-only and non-mutating — safe on any server.
  • Uses only documented, verifiable sources (SERVERPROPERTY 'IsPolyBaseInstalled', sys.dm_exec_compute_nodes, and the HTTP.sys binding) — no fabricated PolyBase-internal queries.
  • Does not manage PolyBase’s internal scale-out-group certificates; it reports them and leaves them to PolyBase.
  • The result carries the findings (IsPolyBaseInstalled, ComputeNodes, and for -IPPort the bound thumbprint, subject and expiry) for an audit record.