Sqlserver安全篇之_手工创建TLS用到的pfx证书文件

lusklusklusk2025-03-09 16:19

Sqlserver官方提供的Windows Powershell脚本

https://learn.microsoft.com/zh-cn/sql/database-engine/configure-windows/configure-sql-server-encryption?view=sql-server-ver16

bash 复制代码

# Define parameters
$certificateParams = @{
    Type = "SSLServerAuthentication"
    Subject = "CN=$env:COMPUTERNAME"
    DnsName = @("$($env:COMPUTERNAME)", $([System.Net.Dns]::GetHostEntry('').HostName), 'localhost')
    KeyAlgorithm = "RSA"
    KeyLength = 2048
    HashAlgorithm = "SHA256"
    TextExtension = "2.5.29.37={text}1.3.6.1.5.5.7.3.1"
    NotAfter = (Get-Date).AddMonths(36)
    KeySpec = "KeyExchange"
    Provider = "Microsoft RSA SChannel Cryptographic Provider"
    CertStoreLocation = "cert:\LocalMachine\My"
}

# Call the cmdlet
New-SelfSignedCertificate @certificateParams

自己测试实验

在woncntestdb3数据库服务器上创建一个自签名的证书，再把这个自签名证书导出到C:\Certs\dainetdaicom.pfx，这个自签名证书的subject必须是woncntestdb3.dai.netdai.com，就算是*.dai.netdai.com或dai.netdai.com都无法把它从C:\Certs\dainetdaicom.pfx导入到woncntestdb3的sqlserver中

bash 复制代码

$certParams = @{
    Type = "SSLServerAuthentication"
    Subject = "CN=$env:COMPUTERNAME.dai.netdai.com"
    DnsName = @("$($env:COMPUTERNAME)", $([System.Net.Dns]::GetHostEntry('').HostName), 'localhost')
    KeyAlgorithm = "RSA"
    KeyLength = 2048
    HashAlgorithm = "SHA256"
    TextExtension = "2.5.29.37={text}1.3.6.1.5.5.7.3.1"
    NotAfter = (Get-Date).AddMonths(36) # 有效期3年
    KeySpec = "KeyExchange"
    Provider = "Microsoft RSA SChannel Cryptographic Provider"
    FriendlyName     = "Certificate test for woncntestdb3.dai.netdai.com"
    CertStoreLocation = "cert:\LocalMachine\My"
}
$cert = New-SelfSignedCertificate @certParams
$password = ConvertTo-SecureString -String "123456" -Force -AsPlainText # 导入到sqlserver中提示输入密码的时候，就填这个密码
$exportPath = "C:\Certs\dainetdaicom.pfx"
Export-PfxCertificate -Cert $cert -FilePath $exportPath -Password $password

--把上面生成的C:\Certs\dainetdaicom.pfx拷贝到Linux路径/root/123/dainetdaicom.pfx，执行如下语句可以看到证书的有效期

bash 复制代码

openssl x509 -in /root/123/dainetdaicom.pfx -noout -dates

证书可以在linux和windows下互用，目前已经成功验证windows下生成的pfx证书可以在linux中使用，但是还没有成功实验linux生成的证书可以在windows下使用