MSSQL with SSL: The target principal name is incorrect
<p>I configured successfully SSL on Microsoft SQL Server 2012 Express Edition for the purpose of encrypting external network connections to the database that are made through Internet. For performance reasons for internal clients on the network I do not want to force the use of SSL and leave to the clients the option of use it or not. I set <strong>Force Encryption</strong> to <strong>No</strong> with the following steps:</p>

<ul>
<li><strong>Sql Server Configuration Manager</strong></li>
<li><strong>Sql Server Network Configuration</strong></li>
<li><strong>Protocols for (MYSQLSERVERNAME)</strong></li>
<li>Right click: <strong>Properties</strong></li>
<li><strong>Flags</strong> tab.</li>
</ul>

<p>When I try to establish an encrypted connection with Microsoft Sql Server Management Studio checking <strong>Encrypt connection</strong> option on <strong>Options</strong> > <strong>Connection Properties</strong> I get the following error.</p>

<blockquote>
  <p>A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - The target principal name is incorrect.) (Microsoft SQL Server, Error: -2146893022)</p>
</blockquote>

<p>What is striking is that if I select <strong>Force Encryption</strong> as <strong>Yes</strong> on Sql Server Configuration Manager and I not select <strong>Encrypt connection</strong> on Microsoft Sql Server Management Studio I can connect to the database. If I execute the query:</p>

<pre><code>select * from sys.dm_exec_connections
</code></pre>

<p>In fact the column <strong>encrypt_option</strong> is TRUE.</p>

<p>The certificate was generated with Openssl and this is the information:</p>

<pre><code>Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
    Signature Algorithm: sha256WithRSAEncryption
        Validity
            Not Before: Jun  9 15:53:18 2016 GMT
            Not After : Jun  9 15:53:18 2018 GMT
        Subject: C=US, ST=State, L=Location, O=Testing, OU=Development, CN=JOSEPH-ASUS
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                ...
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                DB:7F:58:DC:F7:D9:90:2A:DF:0E:31:84:5C:49:68:E7:61:97:D8:41
            X509v3 Authority Key Identifier: 
                keyid:C9:5C:79:34:E0:83:B2:C7:26:21:90:17:6A:86:88:84:95:19:88:EA

            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: 
                Key Encipherment, Data Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Alternative Name: 
                DNS:alternatename1, DNS:alternatename2, IP Address:192.168.1.100, IP Address:192.191.1.101, IP Address:192.168.1.103
    Signature Algorithm: sha256WithRSAEncryption
         ...
</code></pre>

<p>The current OS is Windows 10 Home.</p>

<p>What I'm missing?</p>