Get-DbaInstanceNetworkCertificate

[ksl28]

Summarize Command's Functionality

It would be useful to have a cmdlet, that could show the certificate presented by a SQL server (DB Engine, SSIS, etc).
Dbatools already have a few cmdlets that will show you this, but it requires access to the Windows host itself - which we sometimes do not have access to.

There exists other awesome functions out there that already have this feature - fx Get-SqlServerTlsCertificate (https://gist.github.com/jborean93/44f92e4dfa613c5a1e7889fa7a7c2563).
But it would be beneficial to have the cmdlet natively baked into Dbatools, instead of having to pull multiple ressources.

For me properties like these would be awesome:
Subject Name
Expiration Date
Thumbprint

Is there a command that is similiar or close to what you are looking for?

No

Technical Details

No response

[andreasjordan]

We already have that command: Get-DbaNetworkCertificate

Or am I missing something?

[ksl28]

It seems that Get-DbaNetworkCertificate will try to connect using WinRM - which requires that i have access to the Windows machine. I need a way to just see what certificate, the port is presenting.

[andreasjordan]

Ah, ok, I'll have a look at this later.

[wsmelton]

It's been discussed in Discord about merging jborean code into the command. It does the cert checks more to how Microsoft support tool will do.

[ksl28]

@andreasjordan - Are you aware, if there are any updates on this matter? 😄

[andreasjordan]

No, sorry. Not enough time. First idea: We copy the code from the gist without changes to an internal function inside of dbatools.
But I'm not sure if we add a second public command or add parameters to Get-DbaInstanceNetworkCertificate.

@potatoqualitee - Do you have a suggestion?

[ksl28]

No, sorry. Not enough time. First idea: We copy the code from the gist without changes to an internal function inside of dbatools. But I'm not sure if we add a second public command or add parameters to Get-DbaInstanceNetworkCertificate.

@potatoqualitee - Do you have a suggestion?

No need to apologize - HUGE fan of your work with dbatools, so just glad you are willing to keep it up :)
From a "consumer" perspective, i would say a seperate cmdlet would make the most sense 👍

[andreasjordan]

Then we need a name for the command...

[ksl28]

Then we need a name for the command...

How about one of these?

Get-DbaInstanceCertificateInfo
Test-DbaInstanceCertificate
Inspect-DbaInstanceCertificate
Check-DbaInstanceCertificate

[potatoqualitee]

@claude please review our command names for similar functionality and propose a name then implement a fix

[claude]

Claude finished @potatoqualitee's task —— View job • claude/issue-9112-20251128-1736 • Create PR ➔

---

Implementation Complete ✅

Todo List:

• Review existing dbatools certificate-related commands
• Review Get-DbaNetworkCertificate implementation
• Propose command name following dbatools conventions
• Implement new command
• Create tests for new command
• Register command in module manifests
• Commit and push changes

Analysis

I've reviewed the existing certificate-related commands in dbatools. Here's what I found:

Existing Certificate Commands:

• Get-DbaNetworkCertificate - Gets the certificate configured in SQL Server Configuration Manager (requires Windows host access via WinRM)
• Get-DbaDbCertificate - Gets database-level certificates (for encryption features)
• Get-DbaComputerCertificate - Gets certificates from the Windows certificate store
• Test-DbaComputerCertificateExpiration - Tests certificate expiration

Key Difference:
The existing Get-DbaNetworkCertificate command reads the certificate configuration from the Windows registry and certificate store, requiring WinRM access to the host. The new command retrieves the certificate that SQL Server is presenting over the network by connecting to the SQL Server port directly, similar to what openssl s_client does.

Proposed Command Name

Get-DbaNetworkEncryption ✅

This name is preferred because:

1. ✅ Uses approved PowerShell verb "Get"
2. ✅ Uses singular noun (not plural) per PowerShell standards
3. ✅ Follows the Get-Dba<Noun> pattern
4. ✅ Describes what is being retrieved (the encryption info presented over the network)
5. ✅ Aligns with related commands like Enable-DbaForceNetworkEncryption and Get-DbaForceNetworkEncryption
6. ✅ Clearly differentiates from Get-DbaNetworkCertificate (which gets the configured cert from the host)

Alternative names considered but rejected:

• ❌ Get-DbaInstanceCertificateInfo - Too verbose, uses "Info" suffix which is non-standard
• ❌ Test-DbaInstanceCertificate - "Test" verb implies boolean result, not information retrieval
• ❌ Inspect-DbaInstanceCertificate - "Inspect" is not an approved PowerShell verb
• ❌ Check-DbaInstanceCertificate - "Check" is not an approved PowerShell verb

Implementation Summary

I've successfully implemented the new Get-DbaNetworkEncryption command with the following features:

Key Capabilities:

• ✅ Connects directly to SQL Server's network port via TLS/SSL
• ✅ Retrieves the certificate presented during the TLS handshake
• ✅ No Windows host access required (no WinRM needed)
• ✅ Returns certificate details including:
  • Subject, Issuer, Thumbprint
  • Expiration date (NotAfter/Expires)
  • DNS names from SAN extension
  • Serial number, signature algorithm, version
• ✅ Handles named instances by querying SQL Browser service
• ✅ Supports pipeline input and multiple instances
• ✅ Full comment-based help with examples
• ✅ Pester tests for parameter validation and integration testing
• ✅ Registered in both dbatools.psd1 and dbatools.psm1
• ✅ Author listed as "the dbatools team + Claude"

Example Usage:

# Get certificate from default instance
Get-DbaNetworkEncryption -SqlInstance sql2016

# Get certificate from named instance
Get-DbaNetworkEncryption -SqlInstance sql2016\sqlexpress

# Check expiration across multiple servers
Get-DbaNetworkEncryption -SqlInstance sql2016, sql2017, sql2019 | 
    Select-Object SqlInstance, Subject, Expires, Thumbprint

This addresses the original issue request to view the certificate presented by SQL Server without requiring Windows host access.

Next Steps

---

| Branch: claude/issue-9112-20251128-1736

[potatoqualitee]

@claude pls fix these test failures in the same branch

o 14333
... Starting SQL2016
... Configuring SQL2016
.\Tests\appveyor.pester.ps1
Commit message: Reduced to 1 out of 709 tests
Commit message: Extended to 2 for all the dependencies
Test Groups : Reduced to 1 out of 709 tests
appveyor.pester: Running with Pester Version 5.6.1
Running C:\github\dbatools\tests\Get-DbaNetworkEncryption.Tests.ps1 ...Running C:\github\dbatools\tests\Get-DbaNetworkEncryption.Tests.ps1
[23:20:04][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:05][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:07][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:08][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:09][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:10][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:10][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:11][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:11][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:12][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2017 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
Completed C:\github\dbatools\tests\Get-DbaNetworkEncryption.Tests.ps1 in 15317ms
Uploading artifact TestFailureSummary_Pester5_1.json (214,824 bytes)...100%
Running C:\github\dbatools\tests\Get-DbaNetworkEncryption.Tests.ps1 ...Running C:\github\dbatools\tests\Get-DbaNetworkEncryption.Tests.ps1
[23:20:18][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:19][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:19][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:20][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:20][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:21][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:22][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:23][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:23][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:24][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2017 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
Completed C:\github\dbatools\tests\Get-DbaNetworkEncryption.Tests.ps1 in 6315ms
Uploading artifact TestFailureSummary_Pester5_1.json (215,042 bytes)...100%
Running C:\github\dbatools\tests\Get-DbaNetworkEncryption.Tests.ps1 ...Running C:\github\dbatools\tests\Get-DbaNetworkEncryption.Tests.ps1
[23:20:25][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:26][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:26][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:27][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:27][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:28][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:28][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:29][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2016 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
[23:20:29][Get-DbaNetworkEncryption] Failed to query SQL Browser: Exception calling "Parse" with "1" argument(s): "An invalid IP address was specified."
[23:20:30][Get-DbaNetworkEncryption] Failed to retrieve certificate from APPVYR-WIN\sql2017 | No connection could be made because the target machine actively refused it 10.0.0.128:1433
Completed C:\github\dbatools\tests\Get-DbaNetworkEncryption.Tests.ps1 in 5541ms
Uploading artifact TestFailureSummary_Pester5_1.json (214,689 bytes)...100%
Uploading artifact OverallTestSummary.json (1,183 bytes)...100%
Dumping message log into c:\github\dbatools\dbatools_messages.xml
Skipping dump of error log into c:\github\dbatools\dbatools_errors.xml
.\Tests\appveyor.pester.ps1 -Finalize
Uploading artifact dbatools_messages_and_errors.xml.zip (21,209 bytes)...100%
Failed tests summary:
Path : Get-DbaNetworkEncryption Integration Tests/Certificate retrieval/Should retrieve certificate information from the instance
Name : It Should retrieve certificate information from the instance
Result : Failed
Message : ErrorRecord: Expected a value, but got $null or empty.
StackTrace :
RawErrorRecord : Expected a value, but got $null or empty.
Path : Get-DbaNetworkEncryption Integration Tests/Certificate retrieval/Should return certificate with expected properties
Name : It Should return certificate with expected properties
Result : Failed
Message : ErrorRecord: Expected a value, but got $null or empty.
StackTrace :
RawErrorRecord : Expected a value, but got $null or empty.
Path : Get-DbaNetworkEncryption Integration Tests/Certificate retrieval/Should work with pipeline input
Name : It Should work with pipeline input
Result : Failed
Message : ErrorRecord: Expected a value, but got $null or empty.
StackTrace :
RawErrorRecord : Expected a value, but got $null or empty.
Path : Get-DbaNetworkEncryption Integration Tests/Multiple instances/Should retrieve certificates from multiple instances
Name : It Should retrieve certificates from multiple instances
Result : Failed
Message : ErrorRecord: Expected 2, but got 0.
StackTrace :
RawErrorRecord : Expected 2, but got 0.
Path : Get-DbaNetworkEncryption Unit Tests/Parameter validation/Should have the expected parameters
Name : It Should have the expected parameters
Result : Failed
Message : ErrorRecord: Cannot validate argument on parameter 'Name'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.
StackTrace :
RawErrorRecord : Cannot validate argument on parameter 'Name'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.
Uploading artifact DetailedTestFailures_Pester5.json (4,604 bytes)...100%
5 tests failed.