Enabling SHA2 Certificate Support on Windows Server 2003

hashssl-certificatewindows-server-2003

A little background information first. I have an SSIS package that runs inside a Windows Server 2003 SP2 32 bit environment. The package recently started failing with the following error during a script task which downloads a webpage using an SSL connection:

"The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

Some digging revealed a couple of things: I also could not access the website in question using IE8 from the server (I can with Firefox), and the website had just been issued a new SHA256 certificate.

After doing some research, my current assumption is that the problem is that I don't have support for SHA2 certificates on this server. I grabbed the certificate from the site and ran CertUtil -verify [cert file] which gives the following result:

 The signature of the certificate can not be verified. 0x80096004 (-2146869244)

I found a couple of hotfixes from Microsoft, and from what I understand, either of them should enable support for SHA2 certificates:

So I requested the hotfix for kb968730 and attempted to install it, but got the following error:

The installation cannot continue because the following packages might not be valid:
    KB2616676_V2 c:\windows\system32\dllcache\crypt32.dll 5.131.3790.4905
    KB2616676_V2 c:\windows\system32\crypt32.dll          5.131.3790.4905
Reinstall the packages listed above, and then reinstall KB968730

The version of the crypt32 library that is included with the hotfix is 5.131.3790.4477 which explains why the installer won't proceed.

At this point I'm not quite sure what I need to do. The kb968730 article indicates that crypt32.dll is the only file that is updated by the hotfix which makes me think, since I have a newer version already, shouldn't I already have this functionality? But, it would seem as though I don't, unless I am mistaken about the root cause of the issue.

Best Answer

The Crypt32.dll 5.131.3790.5235 version fixes the issue (after a reboot). It is available at http://support2.microsoft.com/kb/2868626

The previously installed version was 5.131.3790.5014 version and it did not fix the issue. According to this post (https://mendel129.wordpress.com/tag/crypt32-dll/), there are two variants of the 5014 version: one from Windows Update (KB2661254, does not work) and another as a QFE (KB968730).

Related Topic