I have inherited two SQL 2016 servers with two mirrored databases.

They have been built with certificates as they are in a workgroup, the certs expire in six months. I am trying to understand the process to replace the certs with new ones with a longer lifespan, and if the process can be done online with no downtime?

Just to confirm the certs haven't expired yet, I am just being proactive.

I am thinking something like this:

  • Create new certs with longer expiry dates
  • Backup the certs to files and copy between primary and secondary servers
  • Restore the certs with Authorisation to the existing mirror users no need to create new users
  • Alter the existing end points to point to the new certs
  • Clean up

1 Answer 1


To help anyone else with this type of question I was successful in my testing using the following process, with no downtime. I added the certificates, backed them up and copied them during the day but the rest of the process I did out of hours, just normal live precautions.

  • Created New certificates with longer expiry dates
  • Backup and copy the physical certificates between servers
  • Create new certificates on principle / mirror from physical file, giving access to existing users
  • Alter endpoint to use the new certificates
  • Drop old certificates once you are comfortable there are no errors

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.