SQL Server – [SOLVED] “Unable to initialize SSL encryption because a valid certificate could not be found, and it is not possible to create a self-signed certificate."

TL;DR

Generate an appropriate certificate (see below) and plug it into SQL Server Configuration Manager > SQL Server Network Configuration > Protocols for {instance_name} > Properties > Certificate > Certificate

TS;WM

I read through dozens of folks wrestling with this issue and various suggested remedies (reinstalling, sysprep, etc) yet I found none addressing the certificate error directly in this way … so it seems worth getting this message out there.

Root Cause

For me, my SQL Server 2008 R2 (v10.50.1600.1) install went wonky (ran into some group policy brick walls) and somehow the default self-signed certificate must’ve gotten wiped out. Interestingly, on other servers where the install ran without issue, this certificate entry is also blank… so that tells me we’re fortunate SQL Server is able to utilize this new one we throw in.

How to get an appropriate cert

One fairly straight shot at generating self-signed certs is with “SelfSSL.exe” from the IIS 6.0 Resource Kit Tools. Here’s example command line usage:

SelfSSL /N:CN={database server name} /V:1999999

• If you’re not already familiar with certs, the name following “/N:CN=” above must EXACTLY match the “network” name of the machine you’re installing it to… otherwise it gets hidden or rejected at various levels… for example, it won’t show up in SQL Server Configuration Manager’s certificate drop down list… this name should be the “FQDN” (Fully Qualified Domain Name) aka Canonical Name… typically the “Full Computer Name” as listed under Control Panel > System.
• The /V option is the #days the cert is valid for… it appears 1999999 is the max allowed… that currently pushes expiration out to the year 7487, which will hopefully last ya ;)
• Note: SelfSSL often spews “Error opening metabase: 0x80040154” … This would probably be bad news if you wanted to use this certificate for IIS SSL but apparently it’s not a factor for SQL Server SSL.
• Examine the certificates that have been generated this way by launching CertMgr.msc from Win+R and looking into the “Personal” certificate store… or if that doesn’t exist, launch MMC.exe, CTRL+M to add the “Certificates” snap in and select “Computer account”.

In a blatant attempt to cast a wide net on search hits, here’s a typical sql log that’ll be spewed along with the aforementioned error: