- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
MSSQL
Renews the certificate used by a SQL Server instance for encrypted connections.
Supported operating system(s): Windows only.
Adding a MSSQL Server
- On the Renewal Manager tab, click Add Server (or click the MSSQL tile in the connector grid).
- Fill in the fields below.
- Click Submit.
| Field | Applies to | What it means |
|---|---|---|
| Server Name | Required, Add only | A unique display name for this server. Cannot be changed later. Maximum 50 characters. |
| Operating System | Fixed to Windows | MSSQL only runs on Windows targets. |
| Server IP | Required | The IPv4 address CertSecure uses to reach this server. |
| Server Username | Required | The WinRM account used to connect to this server. |
| Server Password | Required | The password for Server Username. Stored encrypted. On Edit, leave blank to keep the existing password. |
MSSQL Server List Actions
Right-click a server row (or open its actions menu) to see:
- View Details – opens a read-only summary of the server's configuration.
- Edit Details – reopens the Add Server form pre-filled, so you can update credentials.
- Manage Endpoints – opens the endpoint list for this server.
- Push Certificate – issues a new certificate for this server and installs it in the Local Machine Personal certificate store, without binding it to an instance or restarting SQL Server. See Pushing a Certificate.
- View Tasks – opens the task history for this server.
- Delete – deletes the server after a confirmation prompt. Deleting a server also removes every endpoint added under it.
Adding a MSSQL Endpoint
- From the server list, open Manage Endpoints on the server (right-click → Manage Endpoints).
- Click Add Endpoint.
- Fill in the fields below.
- Click Submit.
| Field | Applies to | What it means |
|---|---|---|
| Certificate Authority | Required | The CA that will issue renewed certificates for this endpoint. |
| Template | Required | The certificate template/profile to request from the selected CA. Options depend on the CA chosen. |
| Address Type | Required | Whether you will identify this endpoint by IP Address or by Hostname. |
| IP Address / Hostname | Required | The exact address of the TLS service to watch. |
| Port | Required | The TCP port the TLS service listens on, for example 443. |
| Instance Name | Required | The SQL Server instance name. Must match the server's real instance name. Maximum 250 characters. |
| SQL Service Account | Required | The account the SQL Server service runs as, for example NT Service\MSSQL$INSTANCE01. Maximum 200 characters. |
| Owner | Required | The person responsible for this endpoint. Select an organization user from the list. |
| Organization ID | Only when CA = DigiCert | The DigiCert organization ID to request the certificate under. |
| Order Validity | Only when CA = DigiCert | How many days the requested certificate should be valid for. |
Endpoint Actions
From the endpoint list, use the row actions (right-click or the actions menu) to:
- View Details – opens a read-only summary of the endpoint.
- Edit Details – reopens the Add Endpoint form pre-filled, so you can change the certificate settings (Certificate Authority, Template, Owner) and the other endpoint details. The address type, IP address / hostname and port cannot be changed; delete the endpoint and add it again to change them.
- Renew – opens the Renew Endpoint dialog. Available only while automation is disabled for the endpoint.
- Delete – removes this endpoint from the server. It does not affect other endpoints on the same server.
- Change Request – creates a ServiceNow change request for this endpoint. See ServiceNow Change Requests.
Renewing a MSSQL Certificate
- Open Manage Endpoints on the server, find the endpoint, and choose Renew.
-
Pick one of:
- Renew Now – queues the renewal immediately.
- Schedule Renewal – pick a date and time at least 30 minutes from now using Enter Schedule Time.
- Click Renew (or Schedule if you chose to schedule it).
Before you can renew manually:
- The Renewal Manager Agent must be Online.
- Automation must be disabled for that endpoint (see Automatic Renewal). While automation is enabled for an endpoint, its Renew option is unavailable.
- The endpoint must already exist under the server. Add it first if it does not.
What Happens When You Renew
- The agent generates a certificate request tied to the Instance Name and SQL Service Account.
- It submits the request to the CA and receives the new certificate.
- It installs the certificate into the Local Machine Personal certificate store and updates the SQL Server registry pointer to it.
- It restarts the SQL Server service for the change to take effect.
Viewing Tasks
Here’s how to check renewal progress:
- Right-click a server → View Tasks.
- Use Search Keyword, the column filters, or Refresh to find a specific task.
Task Columns
| Column | What it shows |
|---|---|
| Info | A colored status badge: OK, ERROR, PROCESSING, PENDING, INITIALIZED, or WARNING. |
| Task ID | The unique ID of this task. |
| Updated On | When the task status last changed. Filterable by date. |
| Task Name | What kind of task this is, for example a renewal or a scheduled TLS scan. |
| Details | A short description of the current status or the last error. |
| IP Address | The endpoint address(es) involved. |
| Status | The current status text. |
Task Status Meanings
- INITIALIZED – the task was just created and is queued.
- PENDING – waiting for the agent to pick it up.
- PROCESSING – the agent is actively working on it.
- OK – completed successfully.
- WARNING – completed, but with something worth checking.
- ERROR – failed. Check Details for the reason.
Before You Start
- No Certificate Path or Key Path is needed. MSSQL uses the Windows certificate store, not files on disk.
- Instance Name and SQL Service Account must exactly match the configuration on the server for the renewal to succeed.