SQL Mirroring Replace Certificates

Question

I have inherited two SQL 2016 servers with two mirrored databases.

They have been built with certificates as they are in a workgroup, the certs expire in six months. I am trying to understand the process to replace the certs with new ones with a longer lifespan, and if the process can be done online with no downtime?

Just to confirm the certs haven't expired yet, I am just being proactive.

I am thinking something like this:

• Create new certs with longer expiry dates
• Backup the certs to files and copy between primary and secondary servers
• Restore the certs with Authorisation to the existing mirror users no need to create new users
• Alter the existing end points to point to the new certs
• Clean up

Answer 1

To help anyone else with this type of question I was successful in my testing using the following process, with no downtime. I added the certificates, backed them up and copied them during the day but the rest of the process I did out of hours, just normal live precautions.

• Created New certificates with longer expiry dates
• Backup and copy the physical certificates between servers
• Create new certificates on principle / mirror from physical file, giving access to existing users
• Alter endpoint to use the new certificates
• Drop old certificates once you are comfortable there are no errors