Use an encrypted connection (SSL/TLS)
Encrypt the connection to SQL Server and fix certificate trust errors.
Whether the connection to your database is encrypted depends on which of the two addresses you use. The connection strings shown in the Control Panel already contain the right settings, so the safest approach is to copy them as they are.
Local and remote connections
| Connection | Encryption | Settings in the connection string |
|---|---|---|
| Local access — from a website hosted with us | Not encrypted. The connection stays inside our datacenter network and does not go through the public internet. | Encrypt=False |
| Remote access — from your computer or another server | Encrypted with TLS. | Encrypt=True; TrustServerCertificate=True |
A remote connection string from the Control Panel looks like this:
Server=dbXXXX.public.databaseasp.net; Database=dbXXXX; User Id=dbXXXX; Password=your-password; Encrypt=True; TrustServerCertificate=True; MultipleActiveResultSets=True;
Certificate validation
Our SQL Servers use certificates issued by Let's Encrypt for the database host names (dbXXXX.databaseasp.net and dbXXXX.public.databaseasp.net). The Let's Encrypt chain (ISRG Root X1) is trusted by Windows and by Microsoft.Data.SqlClient, so you can let the client verify the certificate:
Server=dbXXXX.public.databaseasp.net; Database=dbXXXX; User Id=dbXXXX; Password=your-password; Encrypt=True; TrustServerCertificate=False; MultipleActiveResultSets=True;
| Setting | What it does |
|---|---|
TrustServerCertificate=True |
Encrypted; the client accepts any certificate. Simplest, shown in the Control Panel, works everywhere. |
TrustServerCertificate=False |
Encrypted; the client checks that the certificate is valid and issued for the host name in Server=. Use it when your security policy requires certificate validation. |
For the validation to succeed, connect with the host name from the Control Panel, never with an IP address. The certificates are renewed automatically before they expire; do not pin a certificate or its fingerprint in your application, because it changes with every renewal.
Warning
For an application that runs on our hosting inside a website we recommend not to use an encrypted connection. The connection between our servers is already secure, and additional encryption can slow the database down.
Where to copy the connection string
Open your database
In the Control Panel go to Databases and open the database.
Open the connection strings
Choose Users and click Connection string next to the login. The window shows one string for Local access and one for Remote access.
Copy the one you need
Click Show with password to see the real password and use the copy icon next to the string.
The same strings are on the Overview page of the database, on the Local access and Remote access tabs.
Note
The remote connection string works only when Remote access is Enabled. See Allow remote access to a database.
Fix the certificate trust error
If your application or tool reports "The certificate chain was issued by an authority that is not trusted", the client is encrypting the connection but cannot verify the certificate of the SQL Server. Usually one of these is the reason:
- You connect with an IP address instead of the host name. The certificate is issued for
dbXXXX.public.databaseasp.net; use that name inServer=. - An old client that does not know the Let's Encrypt root, or a computer with outdated root certificates. Update the client (Microsoft.Data.SqlClient, ODBC Driver 18, the latest SSMS) or run Windows Update.
- A tool that does not validate against the Windows store (some Java or Linux clients). Import the ISRG Root X1 certificate into its trust store, or use its trust server certificate option.
The quick workaround is always the same: add TrustServerCertificate=True to the connection string, or tick Trust server certificate in SQL Server Management Studio (in older versions under Options → Connection Properties, together with Encrypt connection). The connection stays encrypted. See Connect with SQL Server Management Studio.
Important
Keep Encrypt=True in every remote connection string. Over the public internet an unencrypted connection would expose your login, password and data.