I have configured Always Encrypted on a custom database using SQL Server 2016. By default, it creates the certificate with a validity of one year.

Is there any workaround to create this certificate for two or three years at the very beginning stage?

I don't want to rotate the key every year in our production environment rather create the certificate at least for two or three years.

Experts advise please.

  • You don't have to use the ''MSSQL_CERTIFICATE_STORE'' . There are other options including custom provider. Read this and this. If you use Azure key vault you can set your own expiration date. rahulpnath.com/blog/… Apr 3 '18 at 1:58

When this first came out I had a blog post on this, creating the certificate via Powershell: https://justdaveinfo.wordpress.com/2015/10/15/always-on-encrypted-generating-certificates-and-column-encryption-key-encrypted_value/

Checking the documentation for the Powershell cmdlet New-SelfSignedCertificate you should be able to use "-NotAfter (Get-Date).AddMonths(24)"


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.