SQL Server – How to Import Certificates When a Connection Error Indicates Missing Certificates (4228860)

Choose one of the following, in this order of preference for local FglAMs:

A) Use the FglAM keystore (best; survives JRE upgrades)

1). Run this on the host where the local FglAM is installed:

Linux:
{FGLAM_HOME}/bin/fglam --add-certificate alias=/path/to/sqlserver.cer

Windows (PowerShell/CMD):
{FGLAM_HOME}\bin\fglam --add-certificate alias=C:\path\to\sqlserver.cer

2). Then restart the FglAM service.

B) Use the cartridge `certificatetool` (this is require for a FMS in FIPS mode)

1). If the cartridge includes `certificatetool` (under `{FGLAM_HOME}/agents/DB_SQL_Server/<version>/lib`) you can add the cert to the cartridge `fogdb.store`:

Windows:
certificatetool-<ver>.bat --add-certificate host1=C:\path\to\sqlserver.cer

Linux:
chmod u+x certificatetool-<ver>.sh
./certificatetool-<ver>.sh --add-certificate host1=/path/to/sqlserver.cer

2). Restart the FglAM service

C) JVM truststore (fallback)

1). Create/import into a dedicated truststore and point the FglAM JVM at it (or import into `$JAVA_HOME/jre/lib/security/cacerts`):

keytool -importcert -alias sqlserver -file sqlserver.cer -keystore /opt/fglam/truststore/fglam-truststore.jks -storepass changeit -noprompt

2). Then add JVM args (example in baseline.jvmargs.config)

vmparameter.0 = "-Djavax.net.ssl.trustStore=/opt/fglam/truststore/fglam-truststore.jks";
vmparameter.1 = "-Djavax.net.ssl.trustStorePassword=changeit";

3). Restart the FglAM service

How to export the server certificate (if you don't already have it)

Preferred: `keytool` (may work against port 1433):

Linux
keytool -printcert -sslserver SERVERNAME:1433 -rfc > sqlserver.cer

Fallback: `openssl` (extract PEM chain):

Linux
openssl s_client -connect SERVERNAME:1433 -showcerts </dev/null 2>/dev/null | sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' > sqlserver.cer

The following video details how to add the certificate for SQL Server host on FMS servers with in FIPS mode using certificatetool.