You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/t-sql/statements/alter-server-configuration-transact-sql.md
+27-19Lines changed: 27 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: "ALTER SERVER CONFIGURATION (Transact-SQL)"
3
3
description: ALTER SERVER CONFIGURATION (Transact-SQL)
4
4
author: markingmyname
5
5
ms.author: maghan
6
-
ms.date: 08/15/2025
6
+
ms.date: 03/11/2026
7
7
ms.service: sql
8
8
ms.subservice: t-sql
9
9
ms.topic: reference
@@ -206,23 +206,23 @@ The time-out value for how long the SQL Server Database Engine resource DLL shou
206
206
207
207
**Applies to:**[!INCLUDE[sssql25-md](../../includes/sssql25-md.md)] and later versions
208
208
209
-
Use the `CLUSTER_CONNECTION_OPTIONS` clause to enforce [TLS 1.3](../../relational-databases/security/networking/tls-1-3.md) encryption for communication between the Windows Server Failover Cluster and your failover cluster instance. The options are specified as a list of key-value pairs, separated by semicolons. The key-value pairs are used to configure connection string encryption for the failover cluster instance.
209
+
Use the `ClusterConnectionOptions` clause to enforce [TLS 1.3](../../relational-databases/security/networking/tls-1-3.md) encryption for communication between the Windows Server Failover Cluster and your failover cluster instance. The options are specified as a list of key-value pairs, separated by semicolons. The key-value pairs are used to configure connection string encryption for the failover cluster instance.
210
210
211
-
To revert back to default encryption, set the `CLUSTER_CONNECTION_OPTIONS` clause to an empty string. [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] defaults to `Encrypt=Mandatory`, and `TrustServerCertificate=Yes` for connections to the failover cluster instance.
211
+
To revert back to default encryption, set the `ClusterConnectionOptions` clause to an empty string. [!INCLUDE [sssql25-md](../../includes/sssql25-md.md)] defaults to `Encrypt=Mandatory`, and `TrustServerCertificate=Yes` for connections to the failover cluster instance.
212
212
213
213
For more information, review [connect to a failover cluster instance with strict encryption](../../relational-databases/security/networking/connect-with-strict-encryption.md#connect-to-a-failover-cluster-instance) and [TDS 8.0](../../relational-databases/security/networking/tds-8.md).
214
214
215
-
The following table describes the key-value pairs that you can use in the `CLUSTER_CONNECTION_OPTIONS` clause:
215
+
The following table describes the key-value pairs that you can use in the `ClusterConnectionOptions` clause:
216
216
217
217
| Key | Supported values | Description |
218
218
|---|---|---|
219
219
|`Encrypt`|`Mandatory`, `Strict`, `Optional`| Specifies how encryption to the failover cluster instance is enforced. If the server does not support encryption, the connection fails. If encrypt is set to `Mandatory`, then `TrustServerCertificate` must be set to yes. If encrypt is set to `Strict` then `TrustServerCertificate` is ignored. <br /><br /> **This key value pair is required.**|
220
220
|`HostNameInCertificate`| Virtual server name | Specifies virtual server name in the certificate that is used for encryption. This value must match the value in the **Subject Alternative Name** of the certificate. If the server name is listed in the certificate, then you can omit the `HostNameInCertificate` key-value pair. If the server name is not listed in the certificate, then you must specify the `HostNameInCertificate` key-value pair with the virtual server name. <br /><br /> **This key value pair is optional.***|
221
221
|`TrustServerCertificate`|`Yes`, `No`| Set to `yes` to specify that the driver doesn't validate the server TLS/SSL certificate. If `no`, the driver validates the certificate. For more information, review [TDS 8.0](../../relational-databases/security/networking/tds-8.md#additional-changes-to-connection-string-encryption-properties). <br /><br /> **This key value pair is optional.***|
222
222
|`ServerCertificate`| Path to your certificate | If do not want to use `HostNameInCertificate`, you can pass the path to your certificate. The cluster service account must have permission to read the certificate from the given location. <br /><br /> **This key value pair is optional.**|
223
-
|`CLUSTER_CONNECTION_OPTIONS`| Empty string (`''`) | Clears the existing configuration and reverts to default encryption settings of `Encrypt=Mandatory` and `TrustServerCertificate=Yes`. |
223
+
|`ClusterConnectionOptions`| Empty string (`''`) | Clears the existing configuration and reverts to the default encryption settings of `Encrypt=Mandatory` and `TrustServerCertificate=Yes`. |
224
224
225
-
Check the [examples](#e-enforce-strict-encryption-to-your-failover-cluster-instance) to learn how to use the `CLUSTER_CONNECTION_OPTIONS` clause.
225
+
Check the [examples](#e-enforce-strict-encryption-to-your-failover-cluster-instance) to learn how to use the `ClusterConnectionOptions` clause.
226
226
227
227
**\<hadr_cluster_context> ::=**
228
228
@@ -540,32 +540,40 @@ If the server name is listed in the certificate, you can omit the `HostNameInCer
540
540
541
541
```sql
542
542
ALTER SERVER CONFIGURATION
543
-
SET FAILOVER CLUSTER PROPERTY (
544
-
CLUSTER_CONNECTION_OPTIONS='Encrypt=Strict')
543
+
SET FAILOVER CLUSTER PROPERTY
544
+
ClusterConnectionOptions='Encrypt=Strict'
545
545
```
546
546
547
547
548
548
If your server name is not listed as a **Subject Alternative Name** in the certificate, then you must specify whatever value you do have listed in the **Subject Alternative Name** in the `HostNameInCertificate` option.
549
549
550
550
```sql
551
551
ALTER SERVER CONFIGURATION
552
-
SET FAILOVER CLUSTER PROPERTY (
553
-
CLUSTER_CONNECTION_OPTIONS='Encrypt=Strict;HostNameInCertificate=<Subject Alternative Name>')
552
+
SET FAILOVER CLUSTER PROPERTY
553
+
ClusterConnectionOptions='Encrypt=Strict;HostNameInCertificate=<Subject Alternative Name>'
554
554
```
555
555
556
556
If you want to utilize the `ServerCertificate` property instead of providing a value for `HostNameInCertificate`:
If you want to clear the existing configuration, and revert to the default encryption settings of `Encrypt=Mandatory` and `TrustServerCertificate=Yes`, set the `ClusterConnectionOptions` clause to an empty string.
[Change the HADR Cluster Context of Server Instance (SQL Server)](../../database-engine/availability-groups/windows/change-the-hadr-cluster-context-of-server-instance-sql-server.md)
-[Change which cluster manages the metadata for replicas in an Always On availability group](../../database-engine/availability-groups/windows/change-the-hadr-cluster-context-of-server-instance-sql-server.md)
0 commit comments