title: Remote certificate rejected when connecting to SQL Server from Linux host
body: <p>I have been provided a certificate for a SQL Server, which has been successfully installed and activated. I can confirm this from the logs:</p>
  <pre><code>The certificate [Cert Hash(sha1) &quot;xxxxxxxxxxxxxxxxxxE5C050F7D75F58E4E2F&quot;] was successfully loaded for encryption.
  </code></pre>
  <p>Connecting to the database using SSMS is successful, simply by encrypting the connection without trusing the server certificate.</p>
  <p>I wanted to replicate this using WSL and later on - docker.</p>
  <p>I am testing this with a simple .net 6 console application:</p>
  <pre class="lang-cs prettyprint-override"><code>var con = new SqlConnection(&quot;Server=domain.host.eu,50730;Database=databasename;User Id=user;Password='password';&quot;);
  await con.OpenAsync();
  var version = con.ExecuteScalar&lt;string&gt;(&quot;SELECT @@VERSION&quot;);
  Console.WriteLine(version);
  </code></pre>
  <p>This works, if I add <code>Trust Server Certificate=True;</code> to the connection string. Without it, the connection fails:</p>
  <pre><code>Unhandled exception. Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 35 - An internal exception was caught)
   ---&gt; System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback.
     at System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception)
     at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
     at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
     at System.Net.Security.SslStream.AuthenticateAsClient(SslClientAuthenticationOptions sslClientAuthenticationOptions)
     at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
  </code></pre>
  <p>I wanted to extract the certificate from the pfx:</p>
  <pre><code>openssl pkcs12 -in host.domain.eu.pem.pfx -clcerts -nokeys -out host.domain.eu.crt
  sudo cp host.domain.eu.crt /usr/local/share/ca-certificates/
  sudo update-ca-certificates
  </code></pre>
  <p>Unfortunately, this fails with the same error messages and I don't know where I went wrong. I can only assume, that my handling of the certs on Linux is wrong.</p>