- On the Start menu, select Run, and in the Open box, type MMC and select OK.
- In the MMC console, on the File menu, select Add/Remove Snap-in....
- In the Add or Remove Snap-ins dialog box, select Certificates, and then select Add.
- In the Certificates snap-in dialog box, select Computer account, and then select Next > Finish.
- In the Add or Remove Snap-ins dialog box, select OK.
- In the MMC console, expand Certificates (Local Computer) > Personal, right-click Certificates, point to All Tasks, and select Import.
- Complete the Certificate Import Wizard to add a certificate to the computer.
- In the MMC console, right-click the imported certificate, point to All Tasks, and select Manage Private Keys. In the Security dialog box, add read permission for the user account used by the SQL Server service account.
- In SQL Server Configuration Manager, expand SQL Server Network Configuration, right-click Protocols for <server instance>, and select Properties.
- In the Protocols for <instance name> Properties dialog box, on the Certificate tab, select the desired certificate from the dropdown list for the Certificate box, and then select OK.
- If you require all the connections to SQL Server to be encrypted, see Step 2: Configure encryption settings in SQL Server. If you only want to enable encryption for specific clients, restart the SQL Server service and see Special cases for encrypting connections to SQL Server.
Configure SQL Server Database Engine for encryption - SQL Server | Microsoft Learn
Certificate management (SQL Server Configuration Manager) - SQL Server | Microsoft Learn