Skip to content

Connect to Azure SQL with certificate validation instead of disabling it #122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
paolosalvatori merged 2 commits into from
Sep 18, 2026
+9 −7
Merged

Connect to Azure SQL with certificate validation instead of disabling it #122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2d3c428
Connect to SQL with the driver's certificate validation instead of di…
paolosalvatori Sep 18, 2026
cdeebb8
Keep the stored connection string free of TrustServerCertificate too
paolosalvatori Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion samples/web-app-sql-database/python/scripts/deploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,7 +360,7 @@ else
fi

# Build connection string
SQL_CONNECTION_STRING="Server=tcp:${SQL_SERVER_FQDN},1433;Database=${SQL_DATABASE_NAME};User ID=${DATABASE_USER_NAME};Password=${DATABASE_USER_PASSWORD};Encrypt=yes;TrustServerCertificate=yes;Connection Timeout=30;"
SQL_CONNECTION_STRING="Server=tcp:${SQL_SERVER_FQDN},1433;Database=${SQL_DATABASE_NAME};User ID=${DATABASE_USER_NAME};Password=${DATABASE_USER_PASSWORD};Encrypt=yes;Connection Timeout=30;"

# Create secret
echo "Creating secret [$SECRET_NAME] in Key Vault..."
Expand Down
14 changes: 8 additions & 6 deletions samples/web-app-sql-database/python/src/database.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,15 +166,17 @@ def _build_connection_string(self) -> str:
f"Server=tcp:{self.server},1433;"
f"Database={self.database};"
f"Encrypt=yes;"
f"TrustServerCertificate=yes;"
f"Connection Timeout={self.connection_timeout};"
)

# TrustServerCertificate=yes tells the ODBC driver to accept self-signed certificates without verification
# This is appropriate for:
# - Local development with Docker containers
# - Testing environments with self-signed certificates
# - Internal networks where you control the SQL Server
# TrustServerCertificate is deliberately absent: its default is already "no" in ODBC Driver 18,
# so the driver validates the server certificate, which is what Microsoft recommends
# (https://learn.microsoft.com/sql/connect/odbc/major-version-differences#encryption-changes).
# That works against Azure SQL Database and against LocalStack for Azure alike, because the
# emulator serves a publicly trusted certificate for the host name it returns in
# fullyQualifiedDomainName. Add TrustServerCertificate=yes only if LocalStack could not
# download that certificate (for example with SKIP_SSL_CERT_DOWNLOAD=1), in which case the
# server presents a certificate issued by the LocalStack root certificate authority.

if not self.use_azure_credential:
# Traditional SQL authentication
Expand Down
Loading