The message “The certificate chain was issued by an authority that is not trusted” means the client encrypted the connection but could not validate the certificate presented by SQL Server. Treat certificate trust as the fix; do not disable encryption as a reflex.
Last updated: September 26, 2026.
Server=tcp:sql.example.com,1433;
Database=AppDatabase;
Encrypt=True;
TrustServerCertificate=False;The hostname must match a name in the certificate, and the client must trust the issuing certificate authority. Connecting by an IP address or an alias not listed in the certificate can produce a different name-validation failure.
Identify what changed
Recent ODBC, OLE DB, .NET, and SSMS versions may enable encryption or stricter validation by default. Record the driver and version, the exact server name, and whether the problem affects every client or only one machine. Microsoft’s certificate trust troubleshooting guide explains the self-signed and untrusted-CA scenarios.
Use a trusted certificate in production
- Install a certificate intended for server authentication on SQL Server.
- Include the connection hostname in the certificate subject alternative names.
- Give the SQL Server service account access to the private key.
- Configure SQL Server to use the certificate and restart during maintenance.
- Install the issuing root and intermediate certificates on clients as required.
Then keep Encrypt=True and TrustServerCertificate=False so the client validates both encryption and identity.
Use TrustServerCertificate carefully
TrustServerCertificate=True encrypts traffic but skips identity validation. It can be a temporary measure for a controlled development environment, not a silent production default. Document and remove it after establishing trust. Review the broader SQL Server encrypted-connection configuration, then test the same connection method used by the application.
