I'm deploying an active/passive, two node fail over Windows Server 2008 cluster to support a SQL Server 2008 instance. I'm attempting to configure SQL Server to use a certificate issued by my domain's Certificate Authority for Server Authentication. All of the certificate criteria below are met, my difficulty is setting the SSL cert in SQL Server Configuration Manager (SSCM). Though the certificate is available to SQL Server's service account in the Personal certificate store, it is not available in the SSCM MSSQLServer protocol Certificate drop down list.
- The certificate must be in either the local computer certificate store or the current user certificate store.
- The current system time must be after the Valid from property of the certificate and before the Valid to property of the certificate.
- The certificate must be meant for server authentication. This requires the Enhanced Key Usage property of the certificate to specify Server Authentication (188.8.131.52.184.108.40.206.1). The certificate must be created by using the KeySpec option of AT_KEYEXCHANGE. Usually, the certificate's key usage property (KEY_USAGE) will also include key encipherment (CERT_KEY_ENCIPHERMENT_KEY_USAGE).
- The Subject property of the certificate must indicate that the common name (CN) is the same as the host name or fully qualified domain name (FQDN) of the server computer. If SQL Server is running on a failover cluster, the common name must match the host name or FQDN of the virtual server and the certificates must be provisioned on all nodes in the failover cluster.
I had this problem with SQL Server 2005 deployed on Windows Server 2008, but was able to overcome the problem by removing a cluster registry checkpoint, applying the certificate thumb print in the registry setting below, then adding the cluster registry checkpoint back in.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQLServer\SuperSocketNetLib
However, it doesn't appear that the SQL Server 2008 cluster resource has any registry checkpoints, and when I set the registry setting manually on both cluster nodes, the SQL Server will not start.
How do I deploy a SSL Certificate to a 2 node SQL Server 2008 failover cluster on Windows Server 2008 Enterprise?