6.5.4 SQL Server

The SQL Server TLS (registry bind) template writes the certificate thumbprint to the instance’s SuperSocketNetLib registry key and restarts SQL Server.

Set the instance before deployment

The built-in script defaults to SQL Server 2022’s default instance:

HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQLServer\SuperSocketNetLib

It also restarts the default-instance service, MSSQLSERVER.

If the target uses another SQL Server version or a named instance, copy or customize the template and change both the registry path and service name. For example, SQL Server 2019 uses the MSSQL15 version prefix. Confirm the installed instance ID rather than assuming it from the display name.

Private-key access

The SQL Server service account must have read access to the certificate’s private key. Importing the certificate into the Local Machine certificate store does not automatically grant a custom SQL service account access.

If the registry binding succeeds but SQL Server cannot load the certificate, check the SQL Server error log and grant the service identity read access to the private key.

Service interruption

SQL Server reads the new binding during startup. The template restarts the configured SQL Server service with -Force; active connections are interrupted. Use a deployment window appropriate for the database workload.

For a product overview, see certificate automation for SQL Server.