Our Tableau server's SSL certificate (from GoDaddy) expired today so we installed a new one. Users who browse to our Tableau site with Chrome or with Edge have no problems and the browsers indicate that the cert is trusted and good until March. However, three of our users are using Tableau Desktop 26.2.2783. One of them tried to use 'activate by logging into a server' and chose our Tableau server, but received the error 'cannot connect to Tableau Server, server's certificate is not trusted'.
I have confirmed that this user has no problems accessing our Tableau site via browser. it's just the app that gets the certificate error.
#Tableau Desktop & Web Authoring #Security
Glad you got it working. What you found points to the actual cause, though: the server isn't sending the GoDaddy intermediate certificate along with yours. Chrome and Edge quietly fetch a missing intermediate on their own, so the site looks fine in the browser. Tableau Desktop doesn't do that, so it fails unless the intermediate is already in that machine's certificate store, which is why installing the .p7b fixed that one PC.
It may also explain why it broke exactly at renewal: GoDaddy has been moving renewals to a new intermediate (R1), so if the server still has the chain file from the old certificate, it won't match the new one.
If you fix it on the server instead, you won't have to repeat it on every Desktop machine. Tableau Server wants PEM files, not the IIS ones. Download the certificate again from GoDaddy and choose Apache (or Other) as the server type, which gives you your .crt plus a second file with "bundle" in the name. That bundle is the chain. In TSM go to Configuration > Security > External SSL, add it as the certificate chain file next to your cert and key, save and apply pending changes.
Or from the command line:
tsm security external-ssl enable --cert-file .crt --key-file .key --chain-file tsm pending-changes apply
To check what the server sends: openssl s_client -connect yourserver:443 -showcerts. You should see your certificate and, under it, GoDaddy's intermediate (the bundle can add a cross-signed root too, so two or three is fine). If only yours shows up, the chain isn't being sent. Applying the change restarts services, so do it out of hours
