title: What is the purpose of creating a login from a certificate?
body: <p>SQL Server provides the option to create a login from a certificate. E.g.</p>
  <pre><code>USE MASTER;
  CREATE CERTIFICATE &lt;certificateName&gt;
      WITH SUBJECT = '&lt;loginName&gt; certificate in master database',
      EXPIRY_DATE = '12/05/2025';
  GO
  CREATE LOGIN &lt;loginName&gt; FROM CERTIFICATE &lt;certificateName&gt;;
  GO
  </code></pre>
  <p>However, the <a href="http://technet.microsoft.com/en-us/library/ms189751(v=sql.105).aspx" rel="noreferrer">documentation</a> states (emphasis mine):</p>
  <blockquote>
  <p>Logins created from certificates or asymmetric keys are used only for code signing. <strong>They cannot be used to connect to SQL Server</strong>. You can create a login from a certificate or asymmetric key only when the certificate or asymmetric key already exists in master.</p>
  </blockquote>
  <p>What is the point of creating a login that cannot be used to connect to the server?</p>
  <hr />
  <h3>Background</h3>
  <p>We need to make some security changes to our middle-tier application. In particular, how it connects to its database. The <em>powers that be</em> have decreed that: &quot;we cannot use Windows authentication&quot;.<br />
  <em>I know this would normally be the preferred method, but anyone who has access to the middle-tier servers would have the same access to the database as the application</em>.</p>
  <p>If we use SQL authentication, we would need to:</p>
  <ul>
  <li>Encrypt the password.</li>
  <li>Store it in a config file/registry.</li>
  <li>Then decrypt the password when the application needs to connect to the database.</li>
  </ul>
  <p>While the above is possible, I was somewhat hoping that:</p>
  <ul>
  <li>I could use a certificate based login.</li>
  <li>Associate the certificate with the application during the build process.</li>
  <li>And use that to connect to SQL Server.</li>
  </ul>
  <p>The above mentioned extract from the documentaion seems to contradict this.</p>