Ssl – Schannel: Certificate received from the remote server was issued by an untrusted certificate authority

sql-server-2005sslwindows-event-logwindows-server-2008

i'm not sure whether to ask this on dba.stackexchange.com or here.

Periodically following error is logged in Windows Server 2008 Administrative events:

The certificate received from the remote server was issued by an
untrusted certificate authority. Because of this, none of the data
contained in the certificate can be validated. The SSL connection
request has failed. The attached data contains the server certificate.

Log Name: System
Source: Schannel

Followed by:

The following fatal alert was generated: 48. The internal error state
is 552.

Log Name: System
Source: Schannel

If i change the Force Encryption property in SQL-Server Configuration from "No" to "Yes"(see image below) the error would not be logged anymore.

Force Encryption

But i don't really need SSL-Encryption since all connections are trusted(from intranet) and ports 1333 and 1334 are firewalled from internet.

Would it be a performance impact if i would force encryption and generate a server certificate, is it recommended at all in my situation? I don't want to enforce encryption only to prevent from some event logs if it not even causes serious connection problems(where can i see which connection has caused it?).

Q: Can somebody please explain why these errors are raised and wherefrom?

Best Answer

You probably receive this error because a program (SQL Server in your case?) is trying to access a remote resource over an SSL connection but, the SSL certificate used by this remote resource is not trusted by your server.

To find which remote resource your server is trying to access, in Event Viewer, open the Details tab of the event (use the Friendly View). Here the EventData contains the SSL certificate received.

To understand the EventData, scroll down until you see the section In Bytes. Here on the right the Event Viewer decodes the data in text and you should be able to see among all these weird characters a URL, a userPrincipalName, or something like that.

Note: in my case (test lab), my server was trying to access something on my domain controller. Adding the certificate of my DC to the trusted root store solved the problem.

Related Topic