Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to import a new certificate because our old one is going to expire very soon.

The certificate is ok and valid and works for IIS.

Unfortunately SQL Server won't startup with Encryption turned on.

  • I have updated the current Thumbprint in the registry
  • If we revert back to the old key with the old thumbprint, it works.
  • Both certificates are within their data boundaries.

Anyone have any ideas?

share|improve this question
who issued the certificate? what's its keylength? – paulr Jul 21 '09 at 2:14

When you bring up MMC, add the Certificates snap-in for the local computer account and look under the Personal folder, do you see it? That's where the certificate will need to be installed. Also, you'll need to ensure that the certificate for the CA that issued the certificate is installed under Trusted Root Certification Authorities or Intermediate Certification Authorities. SQL Server won't use the certificate if it's in the wrong place or if it can't trust the CA hierarchy.

share|improve this answer

I don't know much about Microsoft-centric cert management, but I usually do things with Java Keytool.exe or with Yellowcat KeyTool IUI v.2.4.1 . Was the cert a renewal with the same serial number or a new cert? Does the keytool -list -v show you any differences? Need more info. Is the cert issuer not in the default trusted cert store?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.