October 13, 2026 at 12:58 pm
Hi, to all of you who are using CA certs on SQL Server boxes to avoid the need to check that pesky 'Trust Server Certificate' box.
It seems there is an industry-wide agreement to shorten the validity period of these certs, down to just 47 days in 2029:
Shorter validity periods coming for SSL/TLS certificates: What it means for you - GoDaddy Blog
Are there efficient ways of dealing with cert renewals? Ideally not requiring restarts of the SQL Server service every time, though I'm not sure that is avoidable.
October 13, 2026 at 8:57 pm
I think that only applies to externally signed certs.
For an enterprise, I would recommend spinning up an enterprise CA server to issue the certs for SQL and then you can define the lifetime as long as you like. Right now externally signed certs can only be issued for 200 days or less, but internally signed ones are whatever you set your internal CA to. You want a 2 year cert, go for it.
This is safe because:
1- company machines should trust the internal CA by default
2- database servers shouldn't be world facing, so no need for a publicly signed cert
One other reason to keep internally signed certs is that you have longer to find outage windows. finding an outage every month so I can reboot my SQL boxes is usually pretty easy, but can result in late nights at my workplace. Others may not have that luxury of monthly outages to SQL to restart services. I can't say for certain with SQL, but a LOT of systems require service restarts to change the certs. I believe SQL Server is the same but I could be wrong on this. Plus if you have a good HA setup, this may not be a problem.
Just my 2 cents mind you.
The above is all just my opinion on what you should do.
As with all advice you find on a random internet forum - you shouldn't blindly follow it. Always test on a test server to see if there is negative side effects before making changes to live!
I recommend you NEVER run "random code" you found online on any system you care about UNLESS you understand and can verify the code OR you don't care if the code trashes your system.
October 14, 2026 at 7:21 am
Hi Brian, thank you for taking the time to respond.
We originally decided to use external certs to avoid the maintenance of local installations of self-signed certs on users' machines. We were unaware of the decreasing validity period for such certs.
Your idea of an enterprise CA server is one which we will investigate. Thank you!
Viewing 3 posts - 1 through 3 (of 3 total)
You must be logged in to reply to this topic. Login to reply