Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 4 down vote favorite

I have a SQL Server that must be accessed using various DNS names (SQL1, sql1.contoso.local, sql1.contoso.com, etc) and I'm struggling with creating a correct SSL certificate that can be used to secure all these name.

I have created SSL certificate with Subject (CN) containing sql1.contoso.com and with several SAN entries: DNS=SQL1, DNS=sql1.contoso.local, etc.

Using this certificate I can connect using encrypted connection only when I use the server sql1.contoso.com. Using other names will result in this error message in SQL Server Management Studio:

A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 0 - The certificate's CN name does not match the passed value.) (Microsoft SQL Server, Error: -2146762481)

I'm connecting to the server from a computer that trusts the CA that issued the SSL certificate used on the SQL Server and all the firewalls are correctly opened to allow connections using the 1433 port.

Is it possible to configure by SQL Server so I can connect to it using several domain names of the server with encrypted connection?

share|improve this question
The lazy answer: why not just always reference the server as sql1.contoso.com? Why do you need multiple aliases to work? – Aaron Bertrand Nov 19 '12 at 18:37
Applications that are using Windows Integrated security are connecting to the server using it's local address because from the Internet only the SQL Logins are enabled. – Jozef Izso Nov 19 '12 at 18:55
And is it possible to add a second certificate? I don't know that certificates can have multiple TLDs. – Aaron Bertrand Nov 19 '12 at 19:01
No, just one certificate per SQL Server Instance (as far as I know). – Jozef Izso Nov 19 '12 at 19:03
Can't you use self-signed certificates for the internal connections? – Aaron Bertrand Nov 19 '12 at 19:13
show 1 more comment

1 Answer

up vote 2 down vote

I'm pretty sure that you'll need a certificate which has multiple CNs not one with DNS entries.

share|improve this answer
I tried to generate a new certificate with multiple CN entries but I wasn't able to connect to the server using any of the defined names in CN entries. :( – Jozef Izso Nov 19 '12 at 22:25
You getting the same error message? Where are you getting the certificate from? – mrdenny♦ Nov 19 '12 at 23:14
The certificate is generated by local CA on domain server. SQL Server trusts this CA. – Jozef Izso Nov 20 '12 at 11:16
Does the client trust the CA? What options were selected when creating the certificate? – mrdenny♦ Nov 20 '12 at 18:43
Yes, the client trusts CA. The certificate was generated using Web Server template. Other filled entries are mentioned in the question. – Jozef Izso Nov 28 '12 at 17:33
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.