3

I have a Amazon Web Services (AWS) Relational Database Service (RDS) instance running SQL Server 2012 Express.

I've installed Amazon's aws.amazon.com/rds certificate in the client machine's Trusted Root Certification Authorities store.

However, when I connect to the RDS instance (using SQL Server Management Studio 2012) and check off "Encrypt Connection", I get the following error:

A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - The target principal name is incorrect.) (Microsoft SQL Server)

What does this mean, and how can I fix it? Thanks!

1
  • are you using the public DNS name of the server?
    – Bozojoe
    Jan 30, 2013 at 2:32

3 Answers 3

3

Add this parameter for the connection string: TrustServerCertificate=true

Solved in my case.

1
  • 1
    You'll be negating the use of a public cert if you do that: you're basically telling the SQL server client to ignore the server cert altogether.
    – Stephane
    Feb 12, 2013 at 12:59
2

Originally we were using the short name which seemed to work for awhile. However, for some reason later it stopped working throwing this error message.

When we changed it to the FQDN it seemed to resolve the issue and again allow it to connect, so anyone experiencing this issue, as a quick fix, may want to check if they are using just the short name of the server and, if so, try using the fully qualified domain name.

0

The error occurs because Amazon does not set the subject name in the SSL certificate issued to the server to the DNS name shown in the RDS console.

If the RDS SQL instance was launched in a VPC, the SSL certificate of the server will unfortunately never pass validation, as its subject (CN) is an IP address different than the public IP assigned to the instance. TrustServerCertificate=true is the only way to connect with SSL in this case; confidentiality (encryption) is provided, but server authentication is not.

If the RDS SQL instance was launched on the EC2-Classic platform (i.e. not in a VPC), the SSL certificate of the server has as its subject a DNS name of the form ec2-NNN-NNN-NNN-NNN.RRRRR.amazonaws.com (where NNN-NNN-NNN-NNN is the public IP address of the instance and RRRRR depends on the region). If you use that DNS name in Management Studio, it should connect without errors.

I discovered the ec2-... DNS name by using nslookup on the DNS name shown in the RDS console, i.e. <name>.<region>.rds.amazon.com. The certificate presented by the server can be examined using Network Monitor.

See also "Using SSL with a SQL Server DB Instance" at http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .