Running into an issue adding new DDCs to an existing CVAD farm. Seems there was some form of SQL hardening and encryption done. I need to have the controllers use TrustServerCertificate=true, but you don't get this option as it pulls the DB string from other controllers. Anyone ever run into something similar, and what did you do to get it going?

is the SQL server using a self signed cert?

Yes. Digging more into this and it might be Server 2025 related. Hitting the Clustername gives Target Principal name is incorrect. Hitting the servers themselves seem ok. Yet all the SPNs seem to be setup correctly.

What about staging the new controller? There is a way to manually register/stage the connection information isn't there?

Tried that as well, no luck. Doing Test-BrokerDBConnections from the new machines and seeing interesting messages when hitting the Listener, vs the servers themselves. I am leaning towards some type of AD/Windows hardening on the new machines.