Schannel: Certificate received from the remote server was issued by an untrusted certificate authority

Question

i'm not sure whether to ask this on dba.stackexchange.com or here.

Periodically following error is logged in Windows Server 2008 Administrative events:

The certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The SSL connection request has failed. The attached data contains the server certificate.

Log Name: System
Source: Schannel

Followed by:

The following fatal alert was generated: 48. The internal error state is 552.

Log Name: System
Source: Schannel

If i change the Force Encryption property in SQL-Server Configuration from "No" to "Yes"(see image below) the error would not be logged anymore.

But i don't really need SSL-Encryption since all connections are trusted(from intranet) and ports 1333 and 1334 are firewalled from internet.

Would it be a performance impact if i would force encryption and generate a server certificate, is it recommended at all in my situation? I don't want to enforce encryption only to prevent from some event logs if it not even causes serious connection problems(where can i see which connection has caused it?).

Q: Can somebody please explain why these errors are raised and wherefrom?

Solution 1

You probably receive this error because a program (SQL Server in your case?) is trying to access a remote resource over an SSL connection but, the SSL certificate used by this remote resource is not trusted by your server.

To find which remote resource your server is trying to access, in Event Viewer, open the Details tab of the event (use the Friendly View). Here the EventData contains the SSL certificate received.

To understand the EventData, scroll down until you see the section In Bytes. Here on the right the Event Viewer decodes the data in text and you should be able to see among all these weird characters a URL, a userPrincipalName, or something like that.

Note: in my case (test lab), my server was trying to access something on my domain controller. Adding the certificate of my DC to the trusted root store solved the problem.

Solution 2

I just saw on Microsoft's site that this is a known issue all the way back to Windows 7. It must still be an issue since the article was just updated a few days ago. Their answer is to turn off Schannel logging and that "this will be fixed in a future release."

Solution 3

Unless you've got a certificate configured for the SQL Server it isn't the SQL Server that is generating the error. It's coming from something else on the system.

Comments

[Tim Schmelter]

Thanks. No, i haven't configured a certificate for SQL-Server since i not really wanted to force encryption, but when i do so(set "force encryption" to 'yes' even if i haven't created a certificate) this error would not be raised.

[Ryan Ferretti]

If there isn't a cert then setting force encryption to yes won't do anything. Also this setting doesn't apply until you restart the database engine. Configuring encryption will increase the CPU load on the server if you did decide to turn it on.

[Tim Schmelter]

But doesn't the errror indicates that a client does not trust the server and not vice versa? I would prefer not to use encryption and this article indicates that one option to prevent this error would be to disable ForceEncryption, but exactly this setting seems to cause this issue. Edit: I have restarted the server after i've changed the setting. Where can i check if a certificate is installed? Maybe that with ForceEncryption='no' causes the error.

[Ryan Ferretti]

Just because the machine is a server doesn't mean that it isn't a client. If there was a problem verifying the info to the Windows update server (or your WSUS server) you'd see this. If someone uses the web browser to browse a site with a bad cert you'll see the error. Use MMC and add in the certificates snapin. Having a cert installed with Force Encryption to no doesn't do anything. As you have force Encryption set to no that KB doesn't apply to you. If you have a bad cert this error will be on the client computer not the SQL Server.

[Michael Hampton]

The link is missing. Please edit your post and add the link.