Finding and Uploading Your SQL Server Certificate

When you create or edit a direct data source, Laserfiche Cloud needs to validate the certificate your SQL Server presents during the TLS handshake. This topic walks through deciding which certificate option to use, locating the correct certificate file if needed, and preparing it for upload.

Note: If you are unfamiliar with the process of creating or obtaining certificates, it is highly recommended that you consult with your IT Department.

Before you begin: This topic assumes TLS/SSL is already configured on your SQL Server instance and that the server is reachable from Laserfiche Cloud over port 1433. See Configuring SQL Server for a direct connection if you haven't completed that setup yet.

Step 1: Decide which certificate option you need

Selecting the certificate option
Your certificate was issued by... Use this option
A well-known public Certificate Authority (for example, DigiCert, GlobalSign, Sectigo, Let's Encrypt) Use Laserfiche Cloud Certificate Store — no upload needed
Your database server itself (self-signed), or your organization's internal/private CA Use custom certificate — upload required (continue below)

Common lists of well-known Certificate Authorities that Laserfiche Cloud may already trust:

Note: While Laserfiche makes every effort to host a comprehensive store of well known certificates, not all certificates may be available at any given time. Consult with your IT department for additional help.

If you're unsure, start with Use Laserfiche Cloud Certificate Store and test the connection. A certificate/trust error when verifying the data source means you need a custom certificate instead.

Step 2: Know the requirements for a custom certificate

If you're using a custom certificate, it must meet all of the following:

  • File format is PEM, DER, or CER
  • Content is base64-encoded
  • It is the server's leaf certificate only — do not upload the root or intermediate certificate
  • It does not include the private key

A correctly formatted certificate file looks like this:

-----BEGIN CERTIFICATE-----
	(base64-encoded certificate content)
-----END CERTIFICATE-----

Step 3: Locate your server certificate

Which method you use depends on whether you can access the database server directly.

Option A: You manage the database server

Use SQL Server Configuration Manager to export the certificate that's already assigned to your SQL Server instance:

  1. On the database server, open SQL Server Configuration Manager.
  2. In the left pane, expand SQL Server Network Configuration, then select Protocols for <instance name> (for example, Protocols for MSSQLSERVER or Protocols for SQLEXPRESS).
  3. Right-click Protocols for <instance name> and select Properties.
  4. On the Certificate tab, confirm the certificate currently assigned to the instance. This is the certificate to export.
  5. Select View, go to the Details tab, and select Copy to File to open the Certificate Export Wizard.
  6. Select No, do not export the private key, then select Next.
  7. Select Base-64 encoded X.509 (.CER), then select Next.
  8. Browse to a location, give the file a name, and select Save, then complete the wizard.
  9. Select Cancel to close the Properties dialog. (You only need to restart the SQL Server service if you're changing which certificate is assigned — exporting a copy of the existing certificate doesn't require a restart.)

Option B: You don't manage the database server (for example, a cloud-hosted database such as Amazon RDS)

When you lack direct administrative access to the database server host, use one of the following methods to obtain the certificate:

  • Request the certificate from your Database Administrator: If your host uses a custom private CA, ask your IT or cloud administrator for the public server (leaf) certificate for the specific database host in base64-encoded PEM/CER format without the private key.

Step 4: Upload the certificate to Laserfiche Cloud

  1. In the data source's Certificate setting, select Use custom certificate.
  2. Browse to the certificate file you exported in Step 3, and select it.
  3. Save and verify the data source.

Troubleshooting

Selecting the certificate option
Symptom Likely cause / fix
Verification fails with a certificate or trust error under Use Laserfiche Cloud Certificate Store Your certificate probably isn't from a well-known public CA. Switch to Use custom certificate and follow Step 3.
Verification fails after uploading a custom certificate Confirm you exported the leaf/server certificate, not the root or an intermediate certificate, and that its Issued To value matches your database's fully qualified domain name.
Verification fails with the error message "A task was canceled." This is a time-out issue that can occur when attempting to access a very large dataset or database with many tables. Grant the database account access only to the views or tables required by the query or queries used.
Upload is rejected Check the file format (PEM, DER, or CER), confirm the content is base64-encoded, and re-export making sure you selected No, do not export the private key.
A previously working data source stops verifying The certificate on the database server was likely renewed or rotated. Re-export the current certificate (Step 3) and re-upload it (Step 4).

Related