2

In SQLServer 2019, is there a way to install multiple SSL certificates in parallel?

I have the following situation: The division the server belongs to was sold and therefore new DNS aliases were registered, everything that was called *.oldcompany.com now has also a new DNS alias *.newcompany.com. Our SQL-Server has now the following names, all pointing to the same server/instance:

Old Company New Company
app1.oldcompany.com app1.newcompany.com
app2.oldcompany.com app2.newcompany.com
app3.oldcompany.com app3.newcompany.com

So far that's straight forward, no issue there, let's request an SSL certificate that contains all these DNS names as Subject Alternative Name... but now comes the tricky bit:

For the old names the old company is in charge, for the new names the new one, both having their own different CAs and certificate chain, so I end up with one certificate for the DNS aliases app1.oldcompany.com, app2.oldcompany.com and app3.oldcompany.com and another one for app1.newcompany.com, app2.newcompany.com and app3.newcompany.com.

I managed to install the certificate of the new company using SQLServer 2019 Configuration Manager and if the connection string contains one of the new DNS aliases everything works fine, both options Encrypt=False or Encrypt=True can be used without the need for TrustServerCertificate=True, but if the connection string contains an old alias, Encrypt=True only works in conjunction with TrustServerCertificate=True.

Is there a way to register both certificates?

2 Answers 2

4

No.

The certificate setting is stored in the registry, at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\Your Instance Name Here\MSSQLServer\SuperSocketNetLib in a key called Certificate. This is a REG_SZ and only allows one thumbprint value, so there's no way to specify multiple certificates. See also the docs.

In theory this could have been supported, as both TLS and TDS have an option for specifying the hostname you are using to connect, but this is not currently supported.

Your only option is to get a single certificate with both names in the Subject Alternative Name field. Many public CAs offer this option, and it's easy to do with a private Microsoft AD CA as well.

If you need a single certificate to be signed by different CAs then that's impossible unless you can get one CA to sign the other CA's root certificate, or for both to cross-sign an intermediate CA certificate which can issue your end certificate.

1
  • I gonna have a look into the cross-signing option, thank you.
    – Christoph
    Commented May 20 at 13:32
2

I haven’t tested with sqlserver yet, but a chance you may be able to work around your dual cert issue here using haproxy to MITM the connection.

This would terminate the incoming certificate with the “wrong” name and re-establish it to the certname the sqlserver has installed.

The haproxy frontend needs the certificate and key.

For the haproxy backend you need to add a host header & set the sni to match the sqlserver. You will also need to reference the relevant ca certificate.

See https://www.slideshare.net/slideshow/haproxy-as-egress-controller/192888584 There is an associated video but there is a lot of content before you get to the TLS details, all of which you can ignore.

This will decrease performance (SSL retermination step) & add another infrastructure component/certs to manage, but it might allow you to keep both DNS names.

1
  • I gonna have a look into it, thank you.
    – Christoph
    Commented May 20 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.