MS SQL Monitor — Certificate Validation Failure When Validate Server Certificate is Enabled

MS SQL Monitor — Certificate Validation Failure When Validate Server Certificate is Enabled

Issue

When Validate Server Certificate is enabled, the MS SQL monitor may fail with the following error:
Warning
"MS SQL : Certificate validation failed. The hostname in the SQL Servers certificate does not match the configured hostname. Please ensure the certificates Common Name (CN) or Subject Alternative Name (SAN) matches the hostname used in Applications Manager......"

This error can occur in either of the following scenarios.


Scenario 1 — Error during Test Connectivity or Monitor Addition

Cause: The SQL Server was configured using an IP address in the Host Name / IP Address field. SSL/TLS certificate validation requires a hostname that matches the certificate's Common Name (CN) or Subject Alternative Name (SAN). Since certificates are typically issued to hostnames rather than IP addresses, validation fails.

Fix: Re-enter the monitor details using the fully qualified hostname (FQDN) instead of the IP address in the Host Name / IP Address field and retry.


Scenario 2 — Error after successful Monitor Addition

Cause: Although the monitor is added successfully, Applications Manager performs a reverse DNS lookup on the SQL Server IP address to obtain the hostname used for SSL certificate validation. If reverse DNS is not configured or returns an unexpected hostname, the hostname may not match the CN or SAN entries in the SQL Server certificate, causing certificate validation to fail and the monitor to turn critical.

Fix:

Option 1 — Update the Hostname from the UI (Recommended)

  1. Navigate to Monitors → Filter by: MS SQL → Overview tab.
  2. In the Monitor Information table, click the Edit (✏️) icon next to the Host Name field. 
  3. Update the field with the correct hostname/FQDN that matches the SQL Server certificate.
  4. Save the changes.
The monitor should recover during the next polling cycle.

Option 2 — Configure Reverse DNS
Configure a PTR record for the SQL Server IP address so that the reverse DNS lookup resolves to the hostname specified in the SQL Server SSL certificate.

Verify that the resolved hostname matches one of the values present in the certificate's Common Name (CN) or Subject Alternative Name (SAN).





                    New to ADSelfService Plus?

                      • Related Articles

                      • Mail Server Monitor - Troubleshooting

                        Common Mail Server Monitor Errors and Troubleshooting Guide 1. Unknown Host Error Description: This error occurs when the mail client cannot resolve the hostname of the mail server to an IP address. The issue typically arises from DNS resolution ...
                      • DNS Monitor - Troubleshooting

                        Common DNS Monitor Errors and Troubleshooting Guide 1. Host Not Found Description: The DNS server was unable to locate the requested lookup address. Possible Causes: This may happen if the hostname is incorrect, the domain does not exist, or there is ...
                      • Troubleshooting URL Monitor

                        When configuring a URL monitor in Applications Manager, you might encounter several errors related to accessibility, configuration, or server-side issues. Below are common errors along with step-by-step troubleshooting instructions to help you ...
                      • Troubleshooting MS SQL Monitor Addition Problems

                        1. Ensure that the SQL Server is running and accessible. Try connecting to the SQL Server instance via SQL Server Management Studio or DBVisualizer using the same credentials. This step helps diagnose connection issues, ensuring that both the server ...
                      • REST API Monitor - FAQS

                        1. What should I do when Basic Authentication fails in the REST API monitor? If Basic Authentication fails in the REST API monitor, follow the steps below to troubleshoot and validate the issue: Ensure that the username and password provided in ...