0

I have configured AE using SSMS on the database server installed with SQL Server 2016. The certificate created under Local Machine option displays the validity as one year.

I just want to know what is the difference between creating a certificate using SSMS and creating a self-signed certificate using PowerShell.

What is a self-signed certificate means in the context of data encryption?

1

I just want to know what is the difference between creating a certificate using SSMS and creating a self-signed certificate using PowerShell.

You have much more control over the options used to create the self-signed certificate through Powershell. There is still the minimum options the certificate needs, but one example you've already mentioned is the valid date.

Other than that, the way it is done doesn't really matter. It's the output (certificate) that's needed.

What is a self-signed certificate means in the context of data encryption?

In this case, not a whole lot. The SSMS cert is still a self signed cert. Self signing just means you're the only authority and no one else can claim you are who and or what you say you are which in this case, doesn't matter. The private and private keys will still be used to encrypt and decrypt regardless where the certificate was made, it just needs to be a valid cert.

You may or may not be bound by using an PKI ( Public Key Infrastructure) you have at your company or using HSM (Hardware Security Module) to store the keys versus just generating a local certificate on your machine for use in other places.

  • Hello Sean, thank you very much for your kind response. If it is not having much difference, then can i create the certificate using PowerShell and create the CEK and CMK keys on SQL Server 2016 database? Basic idea is, my client doesn't want to rotate the default certificate gets created using SSMS in SQL 2016 after one year. – Sri Apr 18 '18 at 1:52
  • So, in this regard, is it safe to create a self-signed certificate and then use it for Always Encrypted based encryption? And also, client will not go for customization options using HSM or similar options. We want to use AE feature by creating the certificate using Local Machine option with three years validity. That's it. – Sri Apr 18 '18 at 1:55
  • And also this certificate needs to be stored at Windows Store location and after that we would giving the read access permissions to the app pool account of our asp.net application for this certificate. Can you please guide me on how to achieve this ? – Sri Apr 18 '18 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.