Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

i'm not sure whether to ask this on ServerFault or here.

Periodically following error is logged in Windows Server 2008 Administrative events:

The certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The SSL connection request has failed. The attached data contains the server certificate.

Log Name: System
Source: Schannel

Followed by:

The following fatal alert was generated: 48. The internal error state is 552.

Log Name: System
Source: Schannel

If i change the Force Encryption property in SQL-Server Configuration from "No" to "Yes"(see image below) the error would not be logged anymore.

Force Encryption

But i don't really need SSL-Encryption since all connections are trusted(from intranet) and ports 1333 and 1334 are firewalled from internet.

Would it be a performance impact if i would force encryption and generate a server certificate, is it recommended at all in my situation? I don't want to enforce encryption only to prevent from some event logs if it not even causes serious connection problems(where can i see which connection has caused it?).

Q: Can somebody please explain why these errors are raised and wherefrom?

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

You're getting those errors because something is trying to connect to SQL Server via SSL, and you don't have a real (signed) certificate trusted by all parties involved.

By setting "Force Encryption" to Yes, you won't make the errors go away - actually, the opposite. You'll make the errors happen everywhere, because you're not fixing the root problem. Right now, only a few things are trying to connect via SSL, but you're about to make EVERYTHING connect via SSL, which means everything will throw those errors. Bad idea.

Instead, track down what's trying to connect via SSL. If it's happening at the same date/time every time, you can set up a trace, or figure out what servers are running batch jobs. Then, THAT server is the one that needs a real cert (as well as the SQL Server) - or just change that application's settings so that it's not trying to connect with SSL.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.