The tlscert Parameter
SQL Relay supports a tlscert parameter in the SQL Relay server's configuration file, and as an argument to the various command line client programs. In either case, it specifies the TLS certificate chain to use.
On non-Windows platforms, it must specify a certificate chain file. For example:
/usr/local/firstworks/etc/sqlrserver.pem
/usr/local/firstworks/etc/sqlrclient.pem
On Windows platforms it may specify a certificate chain file. For example:
C:\\Program Files\\Firstworks\\etc\\sqlrserver.pfx
C:\\Program Files\\Firstworks\\etc\\sqlrclient.pfx
(note the double-backslashes)
Or, it may specify a certificate in a Windows Certificate Store. For example:
CURRENT_USER:MY:sqlrserver
MY:sqlrserver
sqlrserver
CURRENT_USER:MY:sqlrclient
MY:sqlrclient
sqlrclient
For actual files:
- The file should contain the server's certificate, private key, and signing certificates, as appropriate.
- On non-Windows systems, a variety of file formats are supported.
- On Windows systems it must be a .pfx file.
For certificates in a Windows Certificate store:
- The certificate should have an associated private key, and associated signing certificates, as appropriate.
- The parameter must be formatted in one of the following ways:
- location:store:subject
- store:subject
- subject
- The location part must be one of the following:
- CURRENT_USER
- LOCAL_MACHINE
- CURRENT_SERVICE
- SERVICES
- USERS
- CURRENT_USER_GROUP_POLICY
- LOCAL_MACHINE_GROUP_POLICY
- LOCAL_MACHINE_ENTERPRISE
- (if omitted, it defaults to CURRENT_USER)
- The store part must be one of the following:
- MY
- Root
- Trust
- CA
- (if omitted, it defaults to MY)
- The subject part identifies the certificate. The first certificate in the specified location/store who's Subject contains the specified subject (in a case-insensitive comparison) will be used. Note that the order of the certificates in the store is not guaranteed, so the specified subject should contain enough information to uniquely identify a certificate.