Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Amazon Web Services (AWS) Relational Database Service (RDS) instance running SQL Server 2012 Express.

I've installed Amazon's certificate in the client machine's Trusted Root Certification Authorities store.

However, when I connect to the RDS instance (using SQL Server Management Studio 2012) and check off "Encrypt Connection", I get the following error:

A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - The target principal name is incorrect.) (Microsoft SQL Server)

What does this mean, and how can I fix it? Thanks!

share|improve this question
are you using the public DNS name of the server? – Bozojoe Jan 30 '13 at 2:32

Add this parameter for the connection string: TrustServerCertificate=true

Solved in my case.

share|improve this answer
You'll be negating the use of a public cert if you do that: you're basically telling the SQL server client to ignore the server cert altogether. – Stephane Feb 12 '13 at 12:59
This just saved me, thanks alot @Thiago – Chris Marisic Sep 4 '13 at 18:45

Originally we were using the short name which seemed to work for awhile. However, for some reason later it stopped working throwing this error message.

When we changed it to the FQDN it seemed to resolve the issue and again allow it to connect, so anyone experiencing this issue, as a quick fix, may want to check if they are using just the short name of the server and, if so, try using the fully qualified domain name.

share|improve this answer

The error occurs because Amazon does not set the subject name in the SSL certificate issued to the server to the DNS name shown in the RDS console.

If the RDS SQL instance was launched in a VPC, the SSL certificate of the server will unfortunately never pass validation, as its subject (CN) is an IP address different than the public IP assigned to the instance. TrustServerCertificate=true is the only way to connect with SSL in this case; confidentiality (encryption) is provided, but server authentication is not.

If the RDS SQL instance was launched on the EC2-Classic platform (i.e. not in a VPC), the SSL certificate of the server has as its subject a DNS name of the form (where NNN-NNN-NNN-NNN is the public IP address of the instance and RRRRR depends on the region). If you use that DNS name in Management Studio, it should connect without errors.

I discovered the ec2-... DNS name by using nslookup on the DNS name shown in the RDS console, i.e. <name>.<region> The certificate presented by the server can be examined using Network Monitor.

See also "Using SSL with a SQL Server DB Instance" at

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.