Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
24 votes
Accepted

The certificate chain was issued by an authority that is not trusted

On connection pop up click on options Then make sure the "Trust server certificate" is checked
Ashkan S's user avatar
  • 356
10 votes
Accepted

What should my SPN entries look like for each SQL instance?

If you're only using TCP/IP to connect to your instances, you only need the ports specified. The Instance Names are used when connecting to the SQL Instances via the Named Pipes protocols. Sadly the ...
John Eisbrener's user avatar
6 votes
Accepted

how to stop using sql server login credentials in a linked server?

I don't know if you got this resolved or not, but after recently going through our own (re)discovery of the requirements to get delegation running, I figured I could at least provide an answer in the ...
John Eisbrener's user avatar
6 votes

Using DNS per application in ConnectionStrings

What would be the drawbacks of telling my developers to use a DNS entry to point to their respective databases in their ConnectionStrings? Technically, now, one of the drawbacks is that they aren't ...
Sean Gallardy's user avatar
6 votes

The certificate chain was issued by an authority that is not trusted

go advanced "options" and put TrustServerCertificate=True to Additional Connection Parameters
eMKei's user avatar
  • 61
5 votes
Accepted

What is a Forest?

An Active Directory domain is an organizational unit within a Forest. A forest is simply a collection of domains that allows the domains be managed as a unit. Consider an SPN as a domain or forest ...
Hannah Vernon's user avatar
  • 70.1k
5 votes
Accepted

set SPN on SQL cluster

To create a SPN for a SQL FCI, use the FQDN of the FCI instance. For example, if the FCI name is "SQLFCI1" on the contoso domain and it listens on port 22000 with domain account SQLSvcAcct then the ...
Sean Gallardy's user avatar
4 votes
Accepted

Linked server only works if I am on the machine itself. I can't use it from my local computer. what is missing?

This is an issue with Kerberos Authentication. You are connecting to SQL Server on your own laptop, but that service runs under a different process & account than your SSMS session. Then, that SQL ...
AMtwo's user avatar
  • 16.2k
4 votes

Using Kerberos Constrained Delegation with an ADSI Linked Server

I figured this out moments after I posted this - due to our Active Directory being locked down, one of the accounts I was using for testing had the Account is sensitive and cannot be delegated ...
DamonDCD's user avatar
3 votes

Intermittent SQL Delegated Authentication Errors

If your SQL Servers are clustered, and their service accounts are configured to allow them to manage their own Service Principal Names, you might be running into a known issue. In an environment with ...
Hannah Vernon's user avatar
  • 70.1k
3 votes

NTLM vs Kerberos authentication - questions

how can this be that while "Write ServicePrincipalName" privilege is turned off for the SQL service account, domain users are connecting using Kerberos auth That privilege is not required for ...
David Browne - Microsoft's user avatar
3 votes
Accepted

SQL Server - register Service Principle Name without service restart?

Quick answer Question: I have configured everything correctly, but after these changes I want to ensure that SQL Server can register the SPN's successfully- preferably without a service restart as ...
John K. N.'s user avatar
  • 17.9k
3 votes
Accepted

What sort of SPN / AD Computer Delegation do you need for delegation of credentials to a linked server that connects to a file share?

There is only a single kind of Service Principal Name you need for SQL Server. MSSQLSvc/<servername>:<portname> It is typically necessary to implement this twice, one for the short ...
Hannah Vernon's user avatar
  • 70.1k
3 votes
Accepted

Can a server outside the Windows domain connect to a 2nd SQL instance via a linked server?

This is a classic double-hop problem, but in this case, you are using NTLM rather than Kerberos (as it's outside the domain). So it's impossible to do double-hop, as NTLM doesn't support it. Options ...
Charlieface's user avatar
  • 13.2k
2 votes

Kerberos Configuration Manager - Does it work with SQL Server 2016?

This currently is not available yet for SQL Server 2016 unfortunately. You will have to manually add your SPN's using setspn –S MSSQLSvc/<server name>:1433 domain\account EDIT: The Kerberos ...
Stijn Wynants's user avatar
2 votes

MongoDB Fails to get TGT

I think that you missed one step. You should add an entry into the keytab file for your principal mongodb/[email protected] Suppose that the path for your keytab file is /etc/krb5.keytab. ...
MathTruck's user avatar
2 votes

Kerberos authentication not working with Linked Servers in SQL Server 2012

Additional reading on troubleshooting Kerberos errors can be found at the following links Troubleshooting Kerberos Errors (whitepaper) alternate link, wayback machine Debugging Windows Authentication ...
2 votes

What should my SPN entries look like for each SQL instance?

As at 2022-11-30 there seems to be a recently introduced bug (very likely related to KB5019964 and the issues described here: https://mspoweruser.com/kerberos-authentication-issues-due-to-november-...
Mike's user avatar
  • 658
2 votes

What should my SPN entries look like for each SQL instance?

When the SQL Server service creates SPN, it creates two for each instance. This is the format it uses. Default Instance: MSSQLSvc/servername.domain.com MSSQLSvc/servername.domain.com:1433 Named ...
Bob Klimes's user avatar
  • 3,234
2 votes
Accepted

Question on Enabling Kerberos Authentication using SetSPN for Availability Listener alternative DNS name

Yes, a SPN is simply telling the client that when it connects to the specified service (MSSQLSvc) on the specified host (shortername.mydomain.com), the specified principal (MYDOMAIN\SQLSvcAccount) ...
Tony Hinkle's user avatar
  • 7,954
2 votes
Accepted

NTLM vs Kerberos authentication - questions

Kerberos Authentication requires that you have Service Principal Names registered for the services being run by your service account to perform the exchange required for Kerberos authentication to ...
HandyD's user avatar
  • 9,972
2 votes

NTLM vs Kerberos authentication - questions

I can think of at least two ways this could be explained. Someone with adequate rights manually created the SPNs for instances 3 and 4. Instances 3 and 4 ran at least once under a service account ...
Doug Deden's user avatar
  • 1,784
2 votes

Old ODBC app throws "cannot generate sspi context" on Windows 10

When you launch your app using "runas" command, you use some domain user, and that user has Windows login at your SQL server. Or that domain user is part of some AD group that has Windows login at ...
Aleksey Vitsko's user avatar
2 votes
Accepted

Does my PostgreSQL instance support kerberos/gssapi authentication?

First, let me add some more description of the environment where this problem was observed. This excellent series of articles describes setting up kerberos and postgresql PostgreSQL GSSAPI ...
Langley's user avatar
  • 121
2 votes
Accepted

Could I control which protocol will ODBC uses to connect MSSQL on "integrated windows authentication"

SQL Server will always prefer Kerberos over NTLM, however, NTLM is used as a fallback by SQL Server to ensure connectivity. You cannot disable NTLM authentication at the SQL level, this can only be ...
HandyD's user avatar
  • 9,972
2 votes

MS SQL server - linked server target configuration

This is likely a AD delegation issue with the service accounts. All three services needs to be configured to allow delegation. This can be configured in AD using the "Active Directory Users and ...
StrayCatDBA's user avatar
  • 2,088
2 votes
Accepted

New SQL 2022 Servers won't register SPN

Looks like it's something wrong with SPNs. You should create 4 SPNs for each SQL Server service account to suit for different Windows Authentication scenarios. Fully qualified domain name of the ...
rongqing zhu's user avatar
1 vote
Accepted

differences in the authentication scheme - could it be because of Kerberos?

When the auth_scheme is SQL, that means the user is using SQL authentication, which does not, and cannot use Kerboros. When a user that is using Windows authentication connects, authentication will ...
Tony Hinkle's user avatar
  • 7,954
1 vote

Intermittent SQL Delegated Authentication Errors

Does your issue happen to coincide with domain controller maintenance? At my organization, we ran into this problem and started proactively changing our authentication servers before maintenance to ...
Mark Iannucci's user avatar
1 vote

SQL Server Linked Servers not connecting

This is a common error in delegation permission for the linked server connection however you can fix it checking the Kerberos Connectivity or adding but none recommendable SQL Login ID in your Linked ...
Data Slugger's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible