Regarding Root CA Changes for Azure SQL Database and Azure Database for MySQL

Question

Regarding Root CA Changes for Azure SQL Database and Azure Database for MySQL

FU JIE ZHAO 80

Hi Support,

The following two links contain the main content of this question:

Azure SQL: https://learn.microsoft.com/en-us/azure/azure-sql/updates/ssl-root-certificate-expiring?view=azuresql

Azure Database for MySQL: https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-root-certificate-rotation

The link mentions "To maintain our security and compliance standards, we start changing the root certificates for Azure Database for MySQL Flexible Server after September 1, 2025."

The required CA certificates for this change are:

DigiCert Global Root G2
Microsoft ECC Root Certificate Authority 2017
Microsoft RSA Root Certificate Authority 2017

Background: My application is written in Java and utilizes Azure SQL and MySQL. It is currently deployed on AKS. The base image in the Dockerfile is centos-java:1.8.

User's image

Issue: Before September 2025, I checked the Java Trusted Root Certificate Store in the base image file centos-java:1.8 as described in the Azure documentation.

It only contained the CA "DigiCert Global Root G2," and did not include the newly added "Microsoft ECC Root Certificate Authority 2017" and "Microsoft RSA Root Certificate Authority 2017."

User's image

To cope with this change, before September, I changed the database connection parameters in my application to skip root certificate verification.

Azure SQL: encrypt=true;trustServerCertificate=true

Azure MySQL: useSSL=true&requireSSL=true&verifyServerCertificate=false

However, even now in November, when I tested removing these connection parameters, I found that I could still connect to the database, even though my base image file was missing "Microsoft ECC Root Certificate Authority 2017" and "Microsoft RSA Root Certificate Authority 2017."

Unlike others, which normally run Java programs using VMs, we are using AKS, with the node pool system running Ubuntu Linux, and the pods built on the base image centos-java:1.8.

What could be the reason for this? How should I do it correctly?

Kalyani Kondavaradala 3,540 Reputation points Microsoft External Staff Moderator

2025-11-07T13:15:16.01+00:00
Hi FU JIE ZHAO,

Thank you for reaching on Microsoft Q&A!

Please correct me if my understanding is wrong:

Your application, deployed on AKS with a base image of centos-java:1.8, currently only includes the DigiCert Global Root G2 certificate in its Java Trusted Root Certificate Store. As you noted, it doesn’t include the required Microsoft ECC Root Certificate Authority 2017 and Microsoft RSA Root Certificate Authority 2017 before the change takes effect on September 1, 2025.

You mentioned that, despite skipping root certificate verification in your connection strings, you can still successfully connect to both Azure SQL and MySQL databases, which may seem concerning.

Can you please clarify below things.

Have you considered updating your Docker image to include the new required certificates in the Java Trust Store?

Would you like guidance on how to update your Java application's certificate store?

Are you facing any other specific issues with your connection to the databases beyond the certificate verification?
FU JIE ZHAO 80 Reputation points

2025-11-10T03:45:09.5+00:00

Hi @Kalyani Kondavaradala ,

Thank you for your reply.

My database connection parameters were updated before September to bypass root certificate validation. This parameter was changed to True based on Azure documentation.

https://learn.microsoft.com/en-us/azure/azure-sql/updates/ssl-root-certificate-expiring?view=azuresql#how-do-i-know-if-my-application-might-be-affected

At the time, it was unclear whether adding the two required root certificates to centos-java:1.8 would address Azure's updated policy. Therefore, I opted to skip root certificate validation altogether, intending to add the certificates after Azure's policy update in September.

Consequently, the situation described above occurred: even without adding the required certificates and after removing the connection parameter that skips root certificate validation, the database connection still succeeded.

1 answer

Your answer

Kalyani Kondavaradala 3,540 Reputation points Microsoft External Staff Moderator

2025-11-07T13:15:16.01+00:00

Hi FU JIE ZHAO,

Thank you for reaching on Microsoft Q&A!

Please correct me if my understanding is wrong:

Your application, deployed on AKS with a base image of centos-java:1.8, currently only includes the DigiCert Global Root G2 certificate in its Java Trusted Root Certificate Store. As you noted, it doesn’t include the required Microsoft ECC Root Certificate Authority 2017 and Microsoft RSA Root Certificate Authority 2017 before the change takes effect on September 1, 2025.

You mentioned that, despite skipping root certificate verification in your connection strings, you can still successfully connect to both Azure SQL and MySQL databases, which may seem concerning.

Can you please clarify below things.

Have you considered updating your Docker image to include the new required certificates in the Java Trust Store?

Would you like guidance on how to update your Java application's certificate store?

Are you facing any other specific issues with your connection to the databases beyond the certificate verification?
FU JIE ZHAO 80 Reputation points

2025-11-10T03:45:09.5+00:00

Hi @Kalyani Kondavaradala ,

Thank you for your reply.

My database connection parameters were updated before September to bypass root certificate validation. This parameter was changed to True based on Azure documentation.

https://learn.microsoft.com/en-us/azure/azure-sql/updates/ssl-root-certificate-expiring?view=azuresql#how-do-i-know-if-my-application-might-be-affected

At the time, it was unclear whether adding the two required root certificates to centos-java:1.8 would address Azure's updated policy. Therefore, I opted to skip root certificate validation altogether, intending to add the certificates after Azure's policy update in September.

Consequently, the situation described above occurred: even without adding the required certificates and after removing the connection parameter that skips root certificate validation, the database connection still succeeded.

Answer 1

Sina Salam 26,251 Volunteer Moderator

Hello FU JIE ZHAO,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having issue affecting Azure SQL Database and Azure Database for MySQL, especially in Java applications deployed on AKS using a CentOS-based Docker image.

The core issue stems from Azure’s announcement to rotate root certificates starting September 1, 2025, requiring applications to trust three specific CAs: DigiCert Global Root G2, Microsoft ECC Root Certificate Authority 2017, and Microsoft RSA Root Certificate Authority 2017 – https://learn.microsoft.com/en-us/azure/azure-sql/updates/ssl-root-certificate-expiring and https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-root-certificate-rotation

Your Java application behavior results from AKS nodes running Ubuntu Linux, which may provide system-level certificates accessible to containers. Java, depending on its configuration, can fall back to system CA stores, especially in OpenJDK-based environments. To confirm this, you should inspect the certificate chain using openssl from bash command via your Azure CLI:

openssl s_client -connect <your-db-host>:<port> -starttls mysql

This will reveal whether the required Microsoft root certificates are being sourced from the host OS rather than the container’s Java trust store.

To ensure long-term compliance and secure connectivity, you must explicitly add the Microsoft ECC and RSA root certificates to the Java trust store within the Docker image. This can be done using the keytool utility:

keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts \
 -storepass changeit -noprompt -alias ms-ecc-root \
 -file Microsoft_ECC_Root_Certificate_Authority_2017.crt
keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts \
 -storepass changeit -noprompt -alias ms-rsa-root \
 -file Microsoft_RSA_Root_Certificate_Authority_2017.crt

Certificate files can be downloaded from Microsoft’s official repository:

ECC Root: https://www.microsoft.com/pki/mscorp/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt

RSA Root: https://www.microsoft.com/pki/mscorp/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt

Once the certificates are added, re-enable strict certificate validation in the connection strings:

For Azure SQL: encrypt=true;trustServerCertificate=false

For Azure MySQL: useSSL=true&requireSSL=true&verifyServerCertificate=true

Finally, the Docker image should be rebuilt and redeployed to AKS, ensuring the updated trust store is used. Monitoring should be implemented to detect SSL handshake failures and validate the certificate chain periodically. The original issue, any unexpected behavior will be resolved by the above and prepare your application for future enforcement of Azure’s certificate policies.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

FU JIE ZHAO 80 Reputation points

2025-11-11T03:48:42.77+00:00

Hi @Sina Salam

Thank you for your reply.

It seems there's only "DigiCert Global Root G2" and no other two root certificates, which is a bit strange.
Sina Salam 26,251 Reputation points Volunteer Moderator

2025-11-11T13:38:21.01+00:00
Hello FU JIE ZHAO,

Thank you for your feedback.

If only DigiCert Global Root G2 appears, it's not strange but common to many and this means:

The server certificate is signed by an intermediate chained to DigiCert G2.

Your system or container already trusts DigiCert G2.

The Microsoft ECC/RSA roots are not yet required for this connection, but will be in future.

So, what you need to do is to: download all required root certificates:

DigiCert Global Root G2: https://www.digicert.com/kb/digicert-root-certificates.htm

Microsoft RSA Root Certificate Authority 2017: https://www.microsoft.com/pki/mscorp/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt

Microsoft ECC Root Certificate Authority 2017: https://www.microsoft.com/pki/mscorp/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt

Then, import certificates into Java Trust Store by using keytool to import the missing certificates into your Docker image’s Java trust store:

keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts \ -storepass changeit -noprompt -alias ms-ecc-root \ -file Microsoft_ECC_Root_Certificate_Authority_2017.crt keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts \ -storepass changeit -noprompt -alias ms-rsa-root \ -file Microsoft_RSA_Root_Certificate_Authority_2017.crt

Run this to confirm the certs are present using bash command: keytool -list -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit | grep -i microsoft

Then, update connection strings to ensure strict certificate validation is enforced:

Azure SQL: encrypt=true;trustServerCertificate=false

Azure MySQL: useSSL=true&requireSSL=true&verifyServerCertificate=true

After then, rebuild your Docker image with the updated trust store and redeploy to AKS. This ensures consistent behavior across environments.

Then, monitor and for future readiness.

Success.
FU JIE ZHAO 80 Reputation points

2025-11-11T14:41:54.75+00:00

Hi @Sina Salam

Thank you for your reply.

Does this mean that it didn't actually take effect after September? However, I recall that Azure mentioned updating the root certificate during a database maintenance in mid-September, but I couldn't find the specific logs.
Sina Salam 26,251 Reputation points Volunteer Moderator

2025-11-11T16:15:28.95+00:00
Hi FU JIE ZHAO,

Thank you once again.

You're correct that Microsoft announced a root certificate update for Azure SQL Database and Azure Database for MySQL, scheduled to begin after September 1, 2025, as part of their security and compliance improvements. The update involves transitioning from the older DigiCert Global Root CA (SHA-1) to newer, more secure certificates: https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-root-certificate-rotation

However, the fact that your system still connects successfully without the Microsoft ECC/RSA roots suggests that:

The full enforcement of the new root certificates may not yet be active across all regions or services.

Your environment (e.g., AKS node pool or host OS) might already trust the DigiCert G2 certificate, which is still valid and used in the chain.

Azure may be using a transitional certificate chain that still allows connections via DigiCert G2 while gradually phasing in the Microsoft ECC/RSA roots.

Microsoft documentation confirms that during the transition period, all three certificates (old and new) should be present in the trust store to ensure uninterrupted connectivity. The enforcement of the new roots is progressive, and while the change was initiated in September, full enforcement may vary depending on service type, region, and client configuration. - https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-root-certificate-rotation

If you're unable to find specific logs from the September maintenance, it's likely that the update was part of a silent backend rollout rather than a disruptive change, especially if your connection parameters allowed fallback behavior (e.g., trustServerCertificate=true).

To ensure future readiness and avoid unexpected disruptions:

Import the Microsoft ECC and RSA root certificates into your Java trust store.

Enforce strict certificate validation in your connection strings.

Rebuild and redeploy your Docker image with the updated trust store.
FU JIE ZHAO 80 Reputation points

2025-11-12T02:18:24.18+00:00

Thank you @Sina Salam .

I found the maintenance log, which mentions updating the root certificate.

MySQL: https://learn.microsoft.com/en-us/azure/mysql/flexible-server/release-notes/september-2025

I found no logs for Azure SQL, only the following documentation:

https://learn.microsoft.com/en-us/azure/azure-sql/updates/ssl-root-certificate-expiring?view=azuresql

However, there's no expiration date indicating a certificate renewal is required.

Despite this, I can still connect to the database without renewing the certificate. I've tried adding all three certificates to the Java trust store, which also allows connection, but I can't verify if this is normal because I can connect both before and after the update.

Ideally, the test would be "Removing the connection parameters causes the application to fail to connect. Updating the root certificate restores the connection."

Currently, I can connect regardless of whether the connection parameters are removed or updated.

Share via

Regarding Root CA Changes for Azure SQL Database and Azure Database for MySQL

1 answer

Your answer