I am trying to import a new certificate because our old one is going to expire very soon.

The certificate is ok and valid and works for IIS.

Unfortunately SQL Server won't startup with Encryption turned on.

  • I have updated the current Thumbprint in the registry
  • If we revert back to the old key with the old thumbprint, it works.
  • Both certificates are within their data boundaries.

Anyone have any ideas?

  • who issued the certificate? what's its keylength? – paulr Jul 21 '09 at 2:14

When you bring up MMC, add the Certificates snap-in for the local computer account and look under the Personal folder, do you see it? That's where the certificate will need to be installed. Also, you'll need to ensure that the certificate for the CA that issued the certificate is installed under Trusted Root Certification Authorities or Intermediate Certification Authorities. SQL Server won't use the certificate if it's in the wrong place or if it can't trust the CA hierarchy.


I don't know much about Microsoft-centric cert management, but I usually do things with Java Keytool.exe or with Yellowcat KeyTool IUI v.2.4.1 . Was the cert a renewal with the same serial number or a new cert? Does the keytool -list -v show you any differences? Need more info. Is the cert issuer not in the default trusted cert store?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.