ALTER CERTIFICATE (Transact-SQL)
Changes the private key used to encrypt a certificate, or adds one if none is present. Changes the availability of a certificate to Service Broker.
Applies to: SQL Server (SQL Server 2008 through current version).
ALTER CERTIFICATE certificate_name REMOVE PRIVATE KEY | WITH PRIVATE KEY ( <private_key_spec> [ ,... ] ) | WITH ACTIVE FOR BEGIN_DIALOG = [ ON | OFF ] <private_key_spec> ::= FILE = 'path_to_private_key' | DECRYPTION BY PASSWORD = 'key_password' | ENCRYPTION BY PASSWORD = 'password'
The private key must correspond to the public key specified by certificate_name.
The DECRYPTION BY PASSWORD clause can be omitted if the password in the file is protected with a null password.
When the private key of a certificate that already exists in the database is imported from a file, the private key will be automatically protected by the database master key. To protect the private key with a password, use the ENCRYPTION BY PASSWORD phrase.
The REMOVE PRIVATE KEY option will delete the private key of the certificate from the database. You can do this when the certificate will be used to verify signatures or in Service Broker scenarios that do not require a private key. Do not remove the private key of a certificate that protects a symmetric key.
You do not have to specify a decryption password when the private key is encrypted by using the database master key.
Always make an archival copy of a private key before removing it from a database. For more information, see BACKUP CERTIFICATE (Transact-SQL).
The WITH PRIVATE KEY option is not available in a contained database.
A. Changing the password of a certificate
ALTER CERTIFICATE Shipping04 WITH PRIVATE KEY (DECRYPTION BY PASSWORD = 'pGF$5DGvbd2439587y', ENCRYPTION BY PASSWORD = '4-329578thlkajdshglXCSgf'); GO
B. Changing the password that is used to encrypt the private key
ALTER CERTIFICATE Shipping11 WITH PRIVATE KEY (ENCRYPTION BY PASSWORD = '34958tosdgfkh##38', DECRYPTION BY PASSWORD = '95hkjdskghFDGGG4%'); GO
C. Importing a private key for a certificate that is already present in the database
ALTER CERTIFICATE Shipping13 WITH PRIVATE KEY (FILE = 'c:\\importedkeys\Shipping13', DECRYPTION BY PASSWORD = 'GDFLKl8^^GGG4000%'); GO