How to change Certificate on Microsoft SQL Server

SQL Server Database Engine selects a certificate for each instance. The certificate must be installed on the host, readable by the SQL service account, selected in SQL Server Configuration Manager, and activated by restarting that instance.

Before you begin

• Obtain a certificate that satisfies Microsoft's current SQL Server version requirements, contains the server/listener names clients use, and has Server Authentication EKU and a private key.
• Record the instance, service identity, current certificate thumbprint, Force Encryption setting, availability group listeners, and cluster nodes.
• Schedule a failover or outage: the Database Engine restart disconnects clients.

Step-by-step certificate replacement

1. Import the PFX into Cert:\LocalMachine\My on every node that can host the instance or availability-group replica.

2. In certlm.msc, select the new certificate > Manage Private Keys, and grant the SQL Server service identity Read. Without this, the service can fail to start.

3. Open the version-matched SQL Server Configuration Manager. Under SQL Server Network Configuration > Protocols for <instance> > Properties > Certificate, select the new certificate. Review Flags > Force Encryption separately.

4. Restart only that SQL Server service during the maintenance window:

   Restart-Service MSSQLSERVER        # default instance
   # Restart-Service 'MSSQL$INSTANCE' # named instance

5. Repeat on every replica or failover-cluster node. Microsoft documents extra registry handling for failover cluster instances; use Configuration Manager and the current clustered-instance procedure rather than copying a thumbprint blindly.

Product-specific considerations

Enabling Force Encryption changes client behavior and is not inherently part of a certificate renewal. Always On availability groups require the certificate and key on each replica. For cluster instances, preserve the instance-specific SuperSocketNetLib\Certificate configuration and test failover.

Verify the new certificate

Check the SQL Server error log after restart, then connect with encryption and query:

SELECT session_id, encrypt_option, auth_scheme
FROM sys.dm_exec_connections
WHERE session_id = @@SPID;

Validate from a client using the exact listener/server name and certificate validation, not TrustServerCertificate=True.

Rollback

Reselect the old certificate in Configuration Manager, verify its key ACL, and restart the instance. In an HA deployment, fail back only after the restored endpoint passes client validation.

Common problems

• SQL service identity cannot read the private key, so the instance will not start.
• SAN lacks the availability-group listener or client alias.
• Certificate is in Current User or the wrong store/provider.
• Only the current primary replica was updated.
• Clients hide trust/name failures with TrustServerCertificate.

Automating certificate replacement with aethercert

The aethercert SQL Server target imports the certificate, can grant the configured SQL service account private-key read access, writes the instance certificate selection, and can restart the service when explicitly enabled.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

Sources

• Microsoft Learn: configure SQL Server encryption with a certificate