Implement -J flag for server certificate pinning with strict encryption

[Copilot]

Adds the -J flag to specify a server certificate file (PEM, DER, or CER) for certificate pinning when using strict encryption mode. The certificate is matched exactly against the server's TLS certificate, bypassing standard validation (expiry, hostname, trust chain).

Changes

• SQLCmdArguments & ConnectSettings: Added ServerCertificate string field to store certificate path
• Flag registration: Added -J/--server-certificate flag with help text
• Connection string: Pass certificate path via msdsn.Certificate parameter to go-mssqldb driver
• Validation: Enforce -J requires strict encryption (-N s or -N strict)
• Tests: Coverage for valid combinations and invalid usage with non-strict modes

Usage

# Valid: certificate pinning with strict encryption
sqlcmd -S myserver -N s -J /path/to/server.pem

# Invalid: certificate requires strict mode
sqlcmd -S myserver -J /path/to/server.pem
# Error: The -J parameter can only be used with strict encryption mode (-N s or -N strict).

The implementation follows the existing pattern for connection flags like -F (HostNameInCertificate).

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Implement -J flag to allow a specific server certificate be used to encrypt the connection</issue_title>
<issue_description>-J takes a server certificate. This option can be used with the strict encryption mode (-Ys). This option specifies the path to a certificate file to match against the server's connection encryption certificate. The match is done instead of standard certificate validation (expiry, host name, trust chain, etc.) The accepted certificate formats are PEM, DER, and CER. If specified, the server's certificate is checked by seeing if the server certificate provided is an exact match.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Implement -J flag to allow a specific server certificate be used to encrypt the connection #614

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR implements the -J flag to enable server certificate pinning for encrypted SQL Server connections. The feature allows users to specify a path to a certificate file (PEM, DER, or CER format) that will be matched exactly against the server's TLS certificate, bypassing standard certificate validation.

Changes:

• Added ServerCertificate field to SQLCmdArguments and ConnectSettings structs
• Registered -J/--server-certificate flag with validation requiring encryption to be enabled
• Updated go-mssqldb dependency from v1.9.2 to v1.9.6 to support the certificate pinning feature
• Added comprehensive test coverage for valid and invalid flag combinations

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
cmd/sqlcmd/sqlcmd.go	Added ServerCertificate field, validation logic, flag registration, and helper function to check encryption modes
cmd/sqlcmd/sqlcmd_test.go	Added test cases for valid -J flag usage with different encryption modes and invalid combinations
pkg/sqlcmd/connect.go	Added ServerCertificate field to ConnectSettings and passed it to connection string via msdsn.ServerCertificate
go.mod	Updated go-mssqldb dependency from v1.9.2 to v1.9.6
go.sum	Updated checksums for go-mssqldb v1.9.6 and added shopspring/decimal v1.4.0 (transitive dependency)
.gitignore	Added patterns to ignore certificate files and build artifacts

Comments suppressed due to low confidence (1)

cmd/sqlcmd/sqlcmd_test.go:1

• The test case on line 123-125 doesn't verify the EncryptConnection value. The validation function should check both fields are set correctly, similar to line 120-122. Add && args.EncryptConnection == \"true\" to the return statement.

// Copyright (c) Microsoft Corporation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dlevy-msft-sql]

Is -F here still Format? #Resolved

[shueybubbles]

hostnameincertificate

[dlevy-msft-sql]

When I look at sqlcmd -? it has

-F,--format
   Specifies the formatting for results