PowerBI+AWSRDS Postgres18.x .The remote certificate is invalid according to the validation procedure

Power BI Desktop (May 2026) + Amazon RDS PostgreSQL 18.x

“The remote certificate is invalid according to the validation procedure”

Root Cause & Solution

Hi everyone,

I spent nearly an entire day investigating this issue. After ruling out
PostgreSQL, Amazon RDS, SSL/TLS, networking, credentials, and Power BI
settings, I finally identified the root cause.

I couldn’t find this solution documented anywhere, so I’m sharing it
here in case it helps someone else.

Environment

- Power BI Desktop (MSI)
- Version: 2.154.1260.0 (May 2026)
- Windows 11 Build 26200.8655
- Amazon RDS PostgreSQL 18.3
- SSL = ON
- TLS 1.3

------------------------------------------------------------------------

Error

When connecting to PostgreSQL from Power BI Desktop:

The remote certificate is invalid according to the validation
procedure.

The exact same connection worked before updating Power BI Desktop.

------------------------------------------------------------------------

What was already verified

PostgreSQL

- Database running normally
- SSL enabled
- TLS 1.3
- Same error on two different Amazon RDS instances

Network

- Test-NetConnection succeeded
- Port 5432 reachable

DBeaver

- Connected successfully using SSL
- pg_stat_ssl confirmed:
- ssl = true
- version = TLSv1.3

Power BI

- Cleared Data Source Settings
- Removed stored credentials
- Created a brand new connection

Same error.

------------------------------------------------------------------------

Initial assumption

Since PostgreSQL, SSL, networking and DBeaver were all working
correctly, I initially suspected a regression in the PostgreSQL
connector or the embedded Npgsql provider included with the May 2026
release of Power BI Desktop.

------------------------------------------------------------------------

Investigation

Using OpenSSL:

openssl s_client -starttls postgres -connect :5432 -showcerts

The server returned this certificate chain:

Amazon RDS us-east-1 Root CA ECC384 G1 ↓ Amazon RDS us-east-1
Subordinate CA ECC384 G1.A.6 ↓ Server Certificate

OpenSSL also returned:

Verify return code: 19 (self-signed certificate in certificate chain)

------------------------------------------------------------------------

The key discovery

Windows Trusted Root Certificates already contained:

- Amazon RDS us-east-1 Root CA RSA2048 G1

However, the certificate actually used by the server was:

- Amazon RDS us-east-1 Root CA ECC384 G1

These are different Root CAs.

------------------------------------------------------------------------

Another important detail

The official AWS regional certificate bundle contains three Root CAs:

- RSA2048
- RSA4096
- ECC384

The standard Windows Certificate Import Wizard imported only the first
certificate (RSA2048).

The required ECC384 Root CA was never installed.

------------------------------------------------------------------------

Solution

Split the AWS bundle into individual certificates.

The resulting files were:

- cert-1.pem → Amazon RDS Root CA RSA2048 G1
- cert-2.pem → Amazon RDS Root CA RSA4096 G1
- cert-3.pem → Amazon RDS Root CA ECC384 G1

Import the correct certificate:

certutil -addstore -f Root cert-3.pem

Restart Power BI Desktop.

The PostgreSQL connection worked immediately.

------------------------------------------------------------------------

Root Cause

The Amazon RDS instance presented a certificate chain signed by:

Amazon RDS us-east-1 Root CA ECC384 G1

That Root CA was not installed in the Windows Trusted Root Certification
Authorities store.

As a result, Power BI Desktop failed certificate validation and
returned:

“The remote certificate is invalid according to the validation
procedure.”

------------------------------------------------------------------------

Why this was confusing

- PostgreSQL was healthy.
- SSL/TLS was working correctly.
- DBeaver connected successfully.
- Network connectivity was fine.
- The issue only occurred in Power BI Desktop.

Everything pointed toward a Power BI issue, while the actual problem was
the missing ECC384 Root CA trusted by Windows.

------------------------------------------------------------------------

UPDATE

After importing Amazon RDS us-east-1 Root CA ECC384 G1 into the Windows
Local Machine → Trusted Root Certification Authorities store, the issue
was resolved immediately.

No changes were required to:

- PostgreSQL
- Amazon RDS
- SSL configuration
- TLS configuration
- Power BI settings

Only the missing Root CA had to be installed.

------------------------------------------------------------------------

Question for Microsoft

Could the Microsoft Power BI team please confirm whether Power BI
Desktop is expected to automatically trust the newer Amazon RDS ECC384
Root CAs, or if manual installation is currently required?

If this behavior is expected, it would be helpful to document it
officially, as the current error message makes troubleshooting extremely
difficult.

Hopefully this helps anyone facing the same issue.