Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Amazon Web Services (AWS) Relational Database Service (RDS) instance running SQL Server 2012 Express.

I've installed Amazon's aws.amazon.com/rds certificate in the client machine's Trusted Root Certification Authorities store.

However, when I connect to the RDS instance (using SQL Server Management Studio 2012) and check off "Encrypt Connection", I get the following error:

A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - The target principal name is incorrect.) (Microsoft SQL Server)

What does this mean, and how can I fix it? Thanks!

share|improve this question
    
are you using the public DNS name of the server? –  Bozojoe Jan 30 '13 at 2:32
add comment

2 Answers

Add this parameter for the connection string: TrustServerCertificate=true

Solved in my case.

share|improve this answer
    
You'll be negating the use of a public cert if you do that: you're basically telling the SQL server client to ignore the server cert altogether. –  Stephane Feb 12 '13 at 12:59
    
This just saved me, thanks alot @Thiago –  Chris Marisic Sep 4 '13 at 18:45
add comment

The error occurs because Amazon does not set the subject name in the SSL certificate issued to the server to the DNS name shown in the RDS console.

If the RDS SQL instance was launched in a VPC, the SSL certificate of the server will unfortunately never pass validation, as its subject (CN) is an IP address different than the public IP assigned to the instance. TrustServerCertificate=true is the only way to connect with SSL in this case; confidentiality (encryption) is provided, but server authentication is not.

If the RDS SQL instance was launched on the EC2-Classic platform (i.e. not in a VPC), the SSL certificate of the server has as its subject a DNS name of the form ec2-NNN-NNN-NNN-NNN.RRRRR.amazonaws.com (where NNN-NNN-NNN-NNN is the public IP address of the instance and RRRRR depends on the region). If you use that DNS name in Management Studio, it should connect without errors.

I discovered the ec2-... DNS name by using nslookup on the DNS name shown in the RDS console, i.e. <name>.<region>.rds.amazon.com. The certificate presented by the server can be examined using Network Monitor.

See also "Using SSL with a SQL Server DB Instance" at http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.