Skip to content

Commit 2b049d2

Browse files
Merge pull request #36808 from mufukuha/docs-editor/alter-server-configuration-tra-1773100139
Update alter-server-configuration-transact-sql.md
2 parents ae18a13 + 5414dc1 commit 2b049d2

1 file changed

Lines changed: 27 additions & 19 deletions

File tree

docs/t-sql/statements/alter-server-configuration-transact-sql.md

Lines changed: 27 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: "ALTER SERVER CONFIGURATION (Transact-SQL)"
33
description: ALTER SERVER CONFIGURATION (Transact-SQL)
44
author: markingmyname
55
ms.author: maghan
6-
ms.date: 08/15/2025
6+
ms.date: 03/11/2026
77
ms.service: sql
88
ms.subservice: t-sql
99
ms.topic: reference
@@ -206,23 +206,23 @@ The time-out value for how long the SQL Server Database Engine resource DLL shou
206206

207207
**Applies to:** [!INCLUDE[sssql25-md](../../includes/sssql25-md.md)] and later versions
208208

209-
Use the `CLUSTER_CONNECTION_OPTIONS` clause to enforce [TLS 1.3](../../relational-databases/security/networking/tls-1-3.md) encryption for communication between the Windows Server Failover Cluster and your failover cluster instance. The options are specified as a list of key-value pairs, separated by semicolons. The key-value pairs are used to configure connection string encryption for the failover cluster instance.
209+
Use the `ClusterConnectionOptions` clause to enforce [TLS 1.3](../../relational-databases/security/networking/tls-1-3.md) encryption for communication between the Windows Server Failover Cluster and your failover cluster instance. The options are specified as a list of key-value pairs, separated by semicolons. The key-value pairs are used to configure connection string encryption for the failover cluster instance.
210210

211-
To revert back to default encryption, set the `CLUSTER_CONNECTION_OPTIONS` clause to an empty string. [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] defaults to `Encrypt=Mandatory`, and `TrustServerCertificate=Yes` for connections to the failover cluster instance.
211+
To revert back to default encryption, set the `ClusterConnectionOptions` clause to an empty string. [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] defaults to `Encrypt=Mandatory`, and `TrustServerCertificate=Yes` for connections to the failover cluster instance.
212212

213213
For more information, review [connect to a failover cluster instance with strict encryption](../../relational-databases/security/networking/connect-with-strict-encryption.md#connect-to-a-failover-cluster-instance) and [TDS 8.0](../../relational-databases/security/networking/tds-8.md).
214214

215-
The following table describes the key-value pairs that you can use in the `CLUSTER_CONNECTION_OPTIONS` clause:
215+
The following table describes the key-value pairs that you can use in the `ClusterConnectionOptions` clause:
216216

217217
| Key | Supported values | Description |
218218
|---|---|---|
219219
| `Encrypt` | `Mandatory`, `Strict`, `Optional` | Specifies how encryption to the failover cluster instance is enforced. If the server does not support encryption, the connection fails. If encrypt is set to `Mandatory`, then `TrustServerCertificate` must be set to yes. If encrypt is set to `Strict` then `TrustServerCertificate` is ignored. <br /><br /> **This key value pair is required.**|
220220
| `HostNameInCertificate` | Virtual server name | Specifies virtual server name in the certificate that is used for encryption. This value must match the value in the **Subject Alternative Name** of the certificate. If the server name is listed in the certificate, then you can omit the `HostNameInCertificate` key-value pair. If the server name is not listed in the certificate, then you must specify the `HostNameInCertificate` key-value pair with the virtual server name. <br /><br /> **This key value pair is optional.***|
221221
| `TrustServerCertificate` | `Yes`, `No` | Set to `yes` to specify that the driver doesn't validate the server TLS/SSL certificate. If `no`, the driver validates the certificate. For more information, review [TDS 8.0](../../relational-databases/security/networking/tds-8.md#additional-changes-to-connection-string-encryption-properties). <br /><br /> **This key value pair is optional.*** |
222222
|`ServerCertificate` | Path to your certificate | If do not want to use `HostNameInCertificate`, you can pass the path to your certificate. The cluster service account must have permission to read the certificate from the given location. <br /><br /> **This key value pair is optional.** |
223-
| `CLUSTER_CONNECTION_OPTIONS` | Empty string (`''`) | Clears the existing configuration and reverts to default encryption settings of `Encrypt=Mandatory` and `TrustServerCertificate=Yes`. |
223+
| `ClusterConnectionOptions` | Empty string (`''`) | Clears the existing configuration and reverts to the default encryption settings of `Encrypt=Mandatory` and `TrustServerCertificate=Yes`. |
224224

225-
Check the [examples](#e-enforce-strict-encryption-to-your-failover-cluster-instance) to learn how to use the `CLUSTER_CONNECTION_OPTIONS` clause.
225+
Check the [examples](#e-enforce-strict-encryption-to-your-failover-cluster-instance) to learn how to use the `ClusterConnectionOptions` clause.
226226

227227
**\<hadr_cluster_context> ::=**
228228

@@ -540,32 +540,40 @@ If the server name is listed in the certificate, you can omit the `HostNameInCer
540540

541541
```sql
542542
ALTER SERVER CONFIGURATION
543-
SET FAILOVER CLUSTER PROPERTY (
544-
CLUSTER_CONNECTION_OPTIONS = 'Encrypt=Strict')
543+
SET FAILOVER CLUSTER PROPERTY
544+
ClusterConnectionOptions = 'Encrypt=Strict'
545545
```
546546

547547

548548
If your server name is not listed as a **Subject Alternative Name** in the certificate, then you must specify whatever value you do have listed in the **Subject Alternative Name** in the `HostNameInCertificate` option.
549549

550550
```sql
551551
ALTER SERVER CONFIGURATION
552-
SET FAILOVER CLUSTER PROPERTY (
553-
CLUSTER_CONNECTION_OPTIONS = 'Encrypt=Strict;HostNameInCertificate=<Subject Alternative Name>')
552+
SET FAILOVER CLUSTER PROPERTY
553+
ClusterConnectionOptions = 'Encrypt=Strict;HostNameInCertificate=<Subject Alternative Name>'
554554
```
555555

556556
If you want to utilize the `ServerCertificate` property instead of providing a value for `HostNameInCertificate`:
557557

558558
```sql
559559
ALTER SERVER CONFIGURATION
560-
SET FAILOVER CLUSTER PROPERTY (
561-
CLUSTER_CONNECTION_OPTIONS = 'Encrypt=Strict;ServerCertificate=C:\Users\admin\SqlAGCertificate.cer')
560+
SET FAILOVER CLUSTER PROPERTY
561+
ClusterConnectionOptions = 'Encrypt=Strict;ServerCertificate=C:\Users\admin\SqlAGCertificate.cer'
562562
```
563563

564+
If you want to clear the existing configuration, and revert to the default encryption settings of `Encrypt=Mandatory` and `TrustServerCertificate=Yes`, set the `ClusterConnectionOptions` clause to an empty string.
564565

565-
## See Also
566-
[Soft-NUMA &#40;SQL Server&#41;](../../database-engine/configure-windows/soft-numa-sql-server.md)
567-
[Change the HADR Cluster Context of Server Instance &#40;SQL Server&#41;](../../database-engine/availability-groups/windows/change-the-hadr-cluster-context-of-server-instance-sql-server.md)
568-
[sys.dm_os_schedulers &#40;Transact-SQL&#41;](../../relational-databases/system-dynamic-management-views/sys-dm-os-schedulers-transact-sql.md)
569-
[sys.dm_os_memory_nodes &#40;Transact-SQL&#41;](../../relational-databases/system-dynamic-management-views/sys-dm-os-memory-nodes-transact-sql.md)
570-
[sys.dm_os_buffer_pool_extension_configuration &#40;Transact-SQL&#41;](../../relational-databases/system-dynamic-management-views/sys-dm-os-buffer-pool-extension-configuration-transact-sql.md)
571-
[Buffer Pool Extension](../../database-engine/configure-windows/buffer-pool-extension.md)
566+
```sql
567+
ALTER SERVER CONFIGURATION
568+
SET FAILOVER CLUSTER PROPERTY
569+
ClusterConnectionOptions = ''
570+
```
571+
572+
## Related content
573+
574+
- [Soft-NUMA (SQL Server)](../../database-engine/configure-windows/soft-numa-sql-server.md)
575+
- [Change which cluster manages the metadata for replicas in an Always On availability group](../../database-engine/availability-groups/windows/change-the-hadr-cluster-context-of-server-instance-sql-server.md)
576+
- [sys.dm_os_schedulers (Transact-SQL)](../../relational-databases/system-dynamic-management-views/sys-dm-os-schedulers-transact-sql.md)
577+
- [sys.dm_os_memory_nodes (Transact-SQL)](../../relational-databases/system-dynamic-management-views/sys-dm-os-memory-nodes-transact-sql.md)
578+
- [sys.dm_os_buffer_pool_extension_configuration (Transact-SQL)](../../relational-databases/system-dynamic-management-views/sys-dm-os-buffer-pool-extension-configuration-transact-sql.md)
579+
- [Buffer pool extension](../../database-engine/configure-windows/buffer-pool-extension.md)

0 commit comments

Comments
 (0)