SQL Server connect error with SSL Cert

Question

SQL Server connect error with SSL Cert

David Spenner 0

Hello,

I get this error when logging in to an SQL Server instance:

ssl provider error 0 an existing connection was forcibly closed by the remote host error 10054

That happened after I added a certificate to that instance.

The same certificate works on other servers.

I've tried a few different things. After running a trace analysis, I found that there is no response during the TLS handshake.

A “Client Hello” is successful. The “Server Hello” is missing.

grafik

Using IIS Crypto, I configured the server according to "best practices."
I didn't notice anything unusual with the “SQLCheck” script either.

SQLCheck.SERVERNAME.20261014124950.txt

Does anyone else here have any idea what might be causing this?

It's a SERVER 2019 with SQL Server 2022.

Erland Sommarskog 138K Reputation points MVP Volunteer Moderator

2026-10-14T14:24:15.96+00:00

The same certificate works on other servers.

That sounds strange to me. Or more precisely, servers in plural sounds strange to me. To wit, I am under the impression that the certificate needs to include the address that the clients connect to. True, the client can override this with the HostNameInCertificate property in the connection string. Still it sounds strange to me to use the same certificate on multiple instances. But maybe I am missing something?

Did you check the SQL Server errorlog for messages?

1 answer

Your answer

Erland Sommarskog 138K Reputation points MVP Volunteer Moderator

2026-10-14T14:24:15.96+00:00

The same certificate works on other servers.

That sounds strange to me. Or more precisely, servers in plural sounds strange to me. To wit, I am under the impression that the certificate needs to include the address that the clients connect to. True, the client can override this with the HostNameInCertificate property in the connection string. Still it sounds strange to me to use the same certificate on multiple instances. But maybe I am missing something?

Did you check the SQL Server errorlog for messages?

Answer 1

Diagnosis

The client sends its Client Hello and the server never answers. That means Schannel on the server rejected the handshake before replying. The cause is the server's certificate or TLS configuration, not the network or the client.

Check these first

System event log (Schannel source) at the time of a failed login:

36874: no cipher suite in common with the client

36888 with alert 40: handshake or cipher failure

36870: Schannel can’t access the certificate’s private key

SQL ERRORLOG from the last startup: confirm The certificate [Cert Hash(sha1) "D10C512F…"] was successfully loaded for encryption. An error here instead points at the certificate itself.