Skip to content

Commit 354b45a

Browse files
DbaAvailabilityGroup - Add ClusterConnectionOption parameter with TLS 1.3 encryption support (#10035)
1 parent c80e439 commit 354b45a

File tree

4 files changed

+56
-0
lines changed

4 files changed

+56
-0
lines changed

public/New-DbaAvailabilityGroup.ps1

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,25 @@ function New-DbaAvailabilityGroup {
202202
The cluster will request an IP address from DHCP servers on each replica's subnet.
203203
Use this when static IP management is not desired and DHCP reservations can provide consistent addressing.
204204
205+
.PARAMETER ClusterConnectionOption
206+
Specifies connection options for TDS 8.0 support in SQL Server 2025 and above.
207+
This allows the Windows Server Failover Cluster (WSFC) to connect to SQL Server instances using ODBC with TLS 1.3 encryption.
208+
The value is a string containing semicolon-delimited key-value pairs.
209+
210+
Available keys:
211+
- Encrypt: Controls connection encryption
212+
- TrustServerCertificate: Whether to trust the server certificate
213+
- HostNameInCertificate: Expected hostname in the certificate
214+
- ServerCertificate: Path to server certificate
215+
216+
This setting is persisted by WSFC in the registry and used continuously for cluster-to-instance communication.
217+
Note: PowerShell does not validate these values - invalid combinations will be rejected by SMO or the ODBC driver.
218+
219+
Example: "Encrypt=Strict;TrustServerCertificate=False"
220+
221+
For detailed documentation, see:
222+
https://learn.microsoft.com/en-us/sql/t-sql/statements/create-availability-group-transact-sql
223+
205224
.PARAMETER WhatIf
206225
Shows what would happen if the command were to run. No actions are actually performed.
207226
@@ -335,6 +354,7 @@ function New-DbaAvailabilityGroup {
335354
[ipaddress]$SubnetMask = "255.255.255.0",
336355
[int]$Port = 1433,
337356
[switch]$Dhcp,
357+
[string]$ClusterConnectionOption,
338358
[switch]$EnableException
339359
)
340360
begin {
@@ -563,6 +583,10 @@ function New-DbaAvailabilityGroup {
563583
$ag.ReuseSystemDatabases = $ReuseSystemDatabases
564584
}
565585

586+
if ($server.VersionMajor -ge 17 -and $ClusterConnectionOption) {
587+
$ag.ClusterConnectionOptions = $ClusterConnectionOption
588+
}
589+
566590
if ($PassThru) {
567591
$defaults = 'LocalReplicaRole', 'Name as AvailabilityGroup', 'PrimaryReplicaServerName as PrimaryReplica', 'AutomatedBackupPreference', 'AvailabilityReplicas', 'AvailabilityDatabases', 'AvailabilityGroupListeners'
568592
Write-Progress -Activity "Adding new availability group" -Completed

public/Set-DbaAvailabilityGroup.ps1

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,25 @@ function Set-DbaAvailabilityGroup {
5757
Configures the availability group as a Distributed AG that spans multiple WSFC clusters or standalone instances.
5858
Used for disaster recovery scenarios across geographic locations or different domains. Requires SQL Server 2016 or later.
5959
60+
.PARAMETER ClusterConnectionOption
61+
Specifies connection options for TDS 8.0 support in SQL Server 2025 and above.
62+
This allows the Windows Server Failover Cluster (WSFC) to connect to SQL Server instances using ODBC with TLS 1.3 encryption.
63+
The value is a string containing semicolon-delimited key-value pairs.
64+
65+
Available keys:
66+
- Encrypt: Controls connection encryption
67+
- TrustServerCertificate: Whether to trust the server certificate
68+
- HostNameInCertificate: Expected hostname in the certificate
69+
- ServerCertificate: Path to server certificate
70+
71+
This setting is persisted by WSFC in the registry and used continuously for cluster-to-instance communication.
72+
Note: PowerShell does not validate these values - invalid combinations will be rejected by SMO or the ODBC driver.
73+
74+
Example: "Encrypt=Strict;TrustServerCertificate=False"
75+
76+
For detailed documentation, see:
77+
https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-availability-group-transact-sql
78+
6079
.PARAMETER InputObject
6180
Accepts availability group objects from Get-DbaAvailabilityGroup for pipeline operations.
6281
Use this to pipe specific AG objects directly to the function instead of specifying SqlInstance and AG names separately.
@@ -115,6 +134,7 @@ function Set-DbaAvailabilityGroup {
115134
[switch]$BasicAvailabilityGroup,
116135
[switch]$DatabaseHealthTrigger,
117136
[switch]$IsDistributedAvailabilityGroup,
137+
[string]$ClusterConnectionOption,
118138
[parameter(ValueFromPipeline)]
119139
[Microsoft.SqlServer.Management.Smo.AvailabilityGroup[]]$InputObject,
120140
[switch]$EnableException
@@ -142,6 +162,16 @@ function Set-DbaAvailabilityGroup {
142162
$ag.$prop = (Get-Variable -Name $prop -ValueOnly)
143163
}
144164
}
165+
166+
# ClusterConnectionOption requires SQL Server 2025+ (version 17)
167+
if ((Test-Bound -ParameterName ClusterConnectionOption)) {
168+
if ($ag.Parent.VersionMajor -ge 17) {
169+
$ag.ClusterConnectionOptions = $ClusterConnectionOption
170+
} else {
171+
Write-Message -Level Warning -Message "ClusterConnectionOption is only supported in SQL Server 2025 and above. Skipping this setting on $($ag.Parent.Name)."
172+
}
173+
}
174+
145175
$ag.Alter()
146176
$ag
147177
}

tests/New-DbaAvailabilityGroup.Tests.ps1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ Describe $CommandName -Tag UnitTests {
4444
"SubnetMask",
4545
"Port",
4646
"Dhcp",
47+
"ClusterConnectionOption",
4748
"EnableException"
4849
)
4950
Compare-Object -ReferenceObject $expectedParameters -DifferenceObject $hasParameters | Should -BeNullOrEmpty

tests/Set-DbaAvailabilityGroup.Tests.ps1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ Describe $CommandName -Tag UnitTests {
2323
"BasicAvailabilityGroup",
2424
"DatabaseHealthTrigger",
2525
"IsDistributedAvailabilityGroup",
26+
"ClusterConnectionOption",
2627
"InputObject",
2728
"EnableException"
2829
)

0 commit comments

Comments
 (0)