Connecting to SQL Server from ASP.NET Core applications can sometimes result in the error “The certificate chain was issued by an authority that is not trusted.” This occurs because the application does not trust the certificate used by SQL Server by default. Luckily, there are a few ways to resolve this error:
Add TrustServerCertificate=True to the connection string
The easiest solution is to append TrustServerCertificate=True to the SQL Server connection string in your ASP.NET Core application’s configuration. This will tell the connection to trust the certificate presented by SQL Server without further verification.
For example:
"Server=myServer;Database=myDB;User Id=myUser;Password=myPassword;TrustServerCertificate=True;"
While this resolves the issue, security experts caution that blindly trusting any certificate should only be done for development/testing purposes and not in production.
Use Windows Authentication instead of SQL Server Authentication
If you are able to switch to Windows Authentication, the connection will automatically trust the server certificate without the need for TrustServerCertificate=True.
Just change the connection string to integrate Windows Auth:
"Server=myServer;Database=myDB;Integrated Security=True;"
This is more secure than blind certificate trust, but still requires configuring your SQL Server properly for Windows Auth.
Install a valid CA-signed certificate on SQL Server
The most robust solution is to install a valid SSL/TLS certificate on your SQL Server signed by a trusted certificate authority (CA). This will allow the .NET application to verify the certificate chain is valid without blindly trusting any cert.
If your SQL Server instance supports TLS 1.2, you can request a free certificate from a public CA like Let’s Encrypt. Otherwise, you must purchase a certificate from a trusted commercial CA.
Your ASP.NET Core application will connect successfully without any certificate errors with a valid CA-signed certificate.
Conclusion – Certificate Chain
In summary, the “not trusted” error occurs because SQL Server uses a self-signed certificate by default. You can either trust this cert blindly, switch to Windows Auth, or install a proper CA-signed certificate to resolve this issue when connecting from ASP.NET Core apps.
You can further follow me onTwitter.
Reference:Pinal Dave (https://blog.sqlauthority.com)
FAQs
The easiest solution is to append TrustServerCertificate=True to the SQL Server connection string in your ASP.NET Core application's configuration. This will tell the connection to trust the certificate presented by SQL Server without further verification.
How to fix error the certificate chain was issued by an authority that is not trusted? ›
The reason for the error is that SSL certificate used to encrypt the connection to the database is not trusted. There is an easy fix for this by adding TrustServerCertificate=True to the database connection string in your ASP.NET application.
How do I fix server's certificate is not trusted? ›
How to Fix SSL Certificate Error
- Diagnose the problem with an online tool.
- Install an intermediate certificate on my web server.
- Generate a new Certificate Signing Request.
- Upgrade to a dedicated IP address.
- Get a wildcard SSL certificate.
- Change all URLS to HTTPS.
- Renew my SSL certificate.
To resolve the chain issue: Search your Certificate Authority's (CA) website to download their intermediate CA file. This file links all of the trusted CA certificates needed to reach the root certificate. When this Intermediate CA file has been downloaded, you must upload it to the LoadMaster.
How to enable trust server certificate in SQL Server? ›
In SQL Server Configuration Manager, in the console pane, expand SQL Server Network Configuration. Right-click Protocols for <instance Name>, and then select Properties. Select a certificate from the Certificate dropdown list, and then select Apply. Select OK.
How do I remove a not trusted certificate? ›
Instructions for Android
- Open the Settings application, and select the Security option.
- Navigate to the Trusted Credentials.
- Tap on the certificate that you would like to delete.
- Tap Disable.
Chrome
- Right-click the Google Chrome shortcut on your desktop and select Properties.
- In the Target field simple append the following parameter after the quoted string: --ignore-certificate-errors.
Identify Untrusted CA Certificates
- Take a Packet Capture for Unknown Applications. Take a Custom Application Packet Capture. Take a Packet Capture on the Management Interface.
- View and Manage Logs. Log Types and Severity Levels. Traffic Logs. Threat Logs. URL Filtering Logs. WildFire Submissions Logs.
First, check if the URL of the website begins with HTTPS, where S indicates it has an SSL certificate. Second, click on the padlock icon on the address bar to check all the detailed information related to the certificate.
How do you trust a certificate chain? ›
To establish trust in the certificate chain, the web browser or client software relies on a list of trusted Root Certificate Authorities (Root CAs). These Root CAs are pre-installed in the operating system or browser and are considered inherently trusted.
In the Certification Authority snap-in, right-click the CA name, click All Tasks, and then click Restore CA. The Certification Authority Restore Wizard starts. Click Next, and then click Issued certificate log and pending certificate request queue. Type the backup folder location, and then click Next.
What is a certificate authority chain? ›
A certificate chain is an ordered list of certificates, containing an SSL/TLS Certificate and Certificate Authority (CA) Certificates, that enables the receiver to verify that the sender and all CA's are trustworthy.
How to fix the certificate chain was issued by an authority that is not trusted? ›
The easiest solution is to append TrustServerCertificate=True to the SQL Server connection string in your ASP.NET Core application's configuration. This will tell the connection to trust the certificate presented by SQL Server without further verification.
How to check trust certificate for SQL Server? ›
Open SQL Server Configuration Manager. Expand 'SQL Server Network Configuration' and right-click on 'Protocols for [Your Instance Name]'. Select 'Properties', then go to the 'Certificate' tab. Choose your certificate from the dropdown and click 'Apply'.
How to check if SSL is enabled in SQL Server? ›
To identify if SQL SERVER database is SSL enabled or not, run the following query: "SELECT session_id, encrypt_option FROM sys. dm_exec_connections". It should be run by Database Administrator.
How do I fix invalid authority certificate? ›
Troubleshooting the NET:ERR_CERT_AUTHORITY_INVALID Error
- Try visiting the website in another browser like Firefox or Edge. ...
- Clear the browser cache and cookies in Chrome and attempt to reload the page. ...
- Make sure your version of Chrome is up to date. ...
- Check if your system clock and time zone are set correctly.
Various types of SSL certificate errors are like Revoked, Self-Signed & Expired. Additionally, untrusted SSL certificates can be handled using ChromeOptions(), FirefoxOptions() & EdgeOptions() in Chrome, Firefox & Edge browsers respectively.
What does the certificate authority is not trusted mean? ›
The most common cause of a "certificate not trusted" error is that the certificate installation was not properly completed on the server (or servers) hosting the site. Use our SSL Certificate tester to check for this issue. In the tester, an incomplete installation shows one certificate file and a broken red chain.
How do you fix the certificate is not trusted because it is self-signed? ›
You will need to remove a self-signed certificate from the server and install the one issued by the Certificate Authority. Note, when removing a self-signed SSL, please make sure to save the private key, since it will be required for the SSL installation.
Connecting to SQL Server from ASP.NET Core applications can sometimes result in the error “The certificate chain was issued by an authority that is not trusted.” This occurs because the application does not trust the certificate used by SQL Server by default. Luckily, there are a few ways to resolve this error:
