Set-DbaNetworkCertificate - Say why a private key is unsuitable - #10671
Merged
potatoqualitee merged 2 commits intoSep 2, 2026
Conversation
A certificate whose private key lives in a Key Storage Provider - what New-SelfSignedCertificate creates by default - is refused with "Failed checks: PrivateKeyInvalid", which sends people looking at key permissions. The real reason is documented by Microsoft: SQL Server can only use a legacy CSP key created with KeySpec AT_KEYEXCHANGE, CNG keys are not supported at all. Test-DbaNetworkCertificate already knows the key type and key number, but the message did not use them. The failed check now names the requirement and describes the key it found (type and KeyNumber when the key is accessible, otherwise "not accessible or a CNG (Key Storage Provider) key"). The check itself is unchanged - it was right. The PrivateKeyValid description of Test-DbaNetworkCertificate says the same. Verified in the lab on PowerShell 7.6 and 5.1 with a default New-SelfSignedCertificate on the target host: the command refuses with the new message and configures nothing. The new test does the same against InstanceRestart and asserts the message. (do *NetworkCertificate*) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…criptblock in the test Invoke-Command2 wraps plain output in a PSCustomObject unless -Raw is used, so the CNG test handed the command an object with a Length property instead of the thumbprint and failed on the thumbprint format check. (do *NetworkCertificate*)
potatoqualitee
approved these changes
Sep 2, 2026
potatoqualitee
left a comment
potatoqualitee
left a comment
Member
There was a problem hiding this comment.
No material defects found.
Member
|
thank you 🙏🏼 btw fable 5.1 came out today. consensus so far is that it's more token hungry than fable 5 and so far, no bigger payoff, we'll see. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A certificate whose private key lives in a Key Storage Provider - what
New-SelfSignedCertificatecreates by default - is refused bySet-DbaNetworkCertificatewithFailed checks: PrivateKeyInvalid. That sends people looking at key permissions, which are not the problem.Mechanism
SQL Server can only use a legacy CSP private key created with KeySpec
AT_KEYEXCHANGE; CNG keys are not supported at all (Microsoft documentation). So the check was right - it just did not say why it failed.Test-DbaNetworkCertificatealready knows the key type and key number, but the message did not use them.What changed
The failed check now names the requirement and describes the key it found: the type plus
KeyNumberwhen the key is accessible, otherwise "not accessible or a CNG (Key Storage Provider) key". The check itself is unchanged. ThePrivateKeyValiddescription ofTest-DbaNetworkCertificatesays the same.Tests
InstanceRestart: a defaultNew-SelfSignedCertificateon the target host is refused with the new message and nothing is configured; the certificate is tracked and removed again inAfterAll.Set-DbaNetworkCertificate.Tests.ps1green through the testing-dbatools harness against a case sensitive SQL Server 2022 asInstanceRestart. The first harness run caught the test itself handing the command anInvoke-Command2result without-Raw(an object with only aLength), fixed in the second commit.created by Claude and reviewed by Andreas Jordan
🤖 Generated with Claude Code