As part of our security promise, Microsoft is reducing the scope of service-issued certificates in Azure SQL Managed Instance. This may cause a small number of SQL clients to be refused to connect until reconfigured.
Azure SQL Managed Instance is changing how TLS certificates are stored and handled in managed instances. One of those certificates was specifically tailored to support migration scenarios where SQL clients retain the server name, while updating its record in DNS so that it resolves to the managed instance instead. This was supported with an instance certificate that we are now replacing in favor of a more complete solution.
When does this change take effect?
New managed instances already contain certificates with a reduced list of SANs. Existing managed instances will have their certificates revoked and replaced with reduced certificates during the first week of August 2026.
Am I affected?
Your SQL clients and applications might be unable to connect if all of the below is true:
- The client is connecting over the VNet-local endpoint, and
- The client attempts to establish a Redirect connection, and
- Client settings contain the HostNameInCertificate connection parameter.
The exact error message depends on your application, client, and driver. For example:
The target principal name is incorrect. |
The certificate chain was issued by an authority that is not trusted. |
The certificate's CN name does not match the passed value. |
The remote certificate is invalid according to the validation procedure. |
Failed to validate the server name in a certificate |
hostname verification failed |
certificate verify failed: Hostname mismatch |
My clients are affected. What should I do?
If your clients are affected, find an appropriate solution in the table below.
| If the client is... | Solution |
| Connecting to the managed instance's VNet-local endpoint with Redirect using the instance's original VNet-local domain name |
|
| Connecting to the managed instance’s VNet-local endpoint with Redirect using a different domain name (for example, via DNS CNAME) |
|
|
Connecting via private endpoint | No action is needed. |
| Connecting via public endpoint | No action is needed. |
| Connecting with Proxy connection type | No action is needed. |
What else should I know?
Microsoft recommends you adhere to the security best practices for data in flight:
- Only allow network access to known networks and hosts; see Connecting to a managed instance.
- Authorize using safe credentials, ideally by using Microsoft Entra where possible.
- Always use TLS encryption (Encrypt=Strict or Encrypt=Mandatory).
- Monitor suspicious network activity throughout your network topology.
- Follow the principle of least privilege.
- Ensure that your SQL clients and applications have a network path to fetch the latest CRL and/or connect to OCSP for certificate validation.
Microsoft