Technical Anshu
Tutorials Blog
🔐 SQL Server Fix

Install a Real Certificate on SQL Server So Clients Trust the Connection

Client-side checkboxes treat each PC one at a time. A real certificate on the server treats the problem once, for every client, including the ones you have not installed yet. It is a short job with two traps - the private key permission and the name inside the certificate - and this guide walks past both.

✍️ Technical Anshu🔐 SQL Server • Server side fix
🎥 The video covers the fast fix; this page is the permanent one it points towards

Shops often postpone this fix because certificates sound like a specialist topic. For SQL Server it is five concrete steps: get a certificate naming the server, import it with its key, let the service account read the key, select it in Configuration Manager, restart. Do them in that order and the strictest client settings simply start working.

SQL Server Configuration Manager
SQL Server Network Configuration Protocols for MSSQLSERVER > Properties Flags tab ForceEncryption: Yes Certificate tab Certificate: sql01.company.local
The two settings that belong together: encryption required, and a real certificate chosen to serve it. Required with a self-signed certificate is what created the error.
1

What Counts as a Real Certificate Here

Three conditions, all of them checkable before you start:

  1. It is issued by an authority your clients already trust - a public CA, or your own internal CA whose root certificate is installed on the client PCs
  2. The name inside it (the subject or SAN) is the DNS name clients use to connect, for example sql01.company.local - not the IP address, not a nickname
  3. Its stated purpose includes Server Authentication, and it is not expired

If your office runs Active Directory Certificate Services, issuing this takes minutes. If not, a public CA certificate for the server's public name works the same way.

2

Install It Where SQL Server Can Use It

  1. Import the certificate, with its private key, into the Local Computer > Personal store on the SQL Server machine (use certlm.msc)
  2. Right-click the certificate: All Tasks > Manage Private Keys, and grant the SQL Server service account Read permission. Skip this and the service cannot load the certificate - the most common reason this fix silently fails
  3. In SQL Server Configuration Manager, open Protocols for MSSQLSERVER > Properties > Certificate tab and select the certificate from the list
  4. On the Flags tab, set ForceEncryption to Yes if every client should be required to encrypt
  5. Restart the SQL Server service. The change does nothing until you do
3

Confirm the Server Loaded It

After the restart, open the SQL Server error log. A healthy start records a line saying the certificate was successfully loaded for encryption, naming the certificate's thumbprint. If instead the log complains it could not load the certificate, the private-key permission in step 2 is the first place to look. Fixing this before users arrive is the difference between a planned change and a second outage.

4

Connect Like a Stranger Would

Now test from a normal client PC, the strict way:

  1. Connect using the server's DNS name, the name inside the certificate - not its IP address
  2. Set encryption to Mandatory and leave Trust server certificate unticked
  3. The login should succeed with no warning. Run the encrypt_option check from the main guide and confirm it reports TRUE

That passing test is the real finish line: any correctly configured client, including future SSMS versions, now connects with full validation and no special settings.

🔴 The two failure traps, named: a certificate whose name does not match how clients connect, and a service account that cannot read the private key. Together they account for nearly every this did not work report after an otherwise correct install.

🎥 Watch the One Click Fix in the Video

Once the server carries a real certificate, the one click workaround in the video is no longer needed - watch it anyway to see the client side your users met before the fix.

▶️ Watch Full Video
❓ Frequently Asked Questions

Can I use a free public certificate for an internal server name?

Public CAs can only issue for names you prove you own, and internal names like company.local do not qualify. For internal names, an internal certificate authority is the standard answer, and its root is trusted by your domain PCs through Group Policy.

The certificate does not appear in the Configuration Manager list. Why?

Usually because it was imported without its private key, it sits in the wrong store (it must be Local Computer, Personal), or its purpose does not include Server Authentication. All three are checkable in certlm.msc before you restart anything.

Do I need to restart SQL Server after selecting the certificate?

Yes. The certificate is loaded when the service starts. Until the restart, the server keeps presenting the old one and clients keep failing exactly as before.

This guide is based on the Technical Anshu SQL Server fix video • Stuck on a step? Ask in the video comments — you will get a reply 🙏