Event ID 36871 - Repeating TLS Error 10013

Question

Each day shortly after logon, my windows 10 log fills with numerous copies of SChannel Error 36871:

"A fatal error occurred while creating a TLS client credential. The internal error state is 10013."

I do not see any symptoms of this error that I recognize as such - failed secure connections etc.

The error occurs both before and after domain connectivity is established - as indicated by NtpClient.

Despite the error being "fatal", it repeats 2-4 times, followed by an increasing pause before repeating again.

My question is, first and foremost, what does internal error state 10013 indicate?

Answer 1

Confirmed: re-enabling SSLv3.0 in IISCrypto cleared up the SChannel error - which still seems to have no impact on my system at all. Ah the exercise of irrelevancy.

Answer 2

Technet thread on the same error for SSL (https://social.technet.microsoft.com/Forums/ie/en-US/aaced205-b0ec-4874-b440-8075dd74d8df/a-fatal-error-occurred-while-creating-an-ssl-client-credential-the-internal-error-state-is-10013?forum=exchangesvradmin) suggested 2 solutions:

1. FIPs only cryptography - set in security policy
2. %ProgramData%\Microsoft\Crypto\RSA\MachineKeys file permissions

I didn't think that a policy change should be needed to fix the error, so I looked into option 2 & found that folder/file permissions are nuts at that path: everything from Domain Admin doesn't even have the right to read permissions down to one file that had everyone full control... I chose the middle ground & granted Administrators & Network Service read access & SYSTEM Full Control.

Ideally, in a few days I will get back on & confirm whether that had any effect.

Answer 3

Ideally, in a few days I will get back on & confirm whether that had any effect.

Still erroring.

On this technet thread: https://social.technet.microsoft.com/Forums/ie/en-US/aaced205-b0ec-4874-b440-8075dd74d8df/a-fatal-error-occurred-while-creating-an-ssl-client-credential-the-internal-error-state-is-10013?forum=exchangesvradmin

Cody Bilbro suggested IISCrypto server defaults. I will do that for now & if it resolves the error, i will start locking it down - server defaults is not the most secure set of options.

Again, ideally, in a few days, I will get back on this thread and report one way or the other.

Answer 4

Preliminary findings are that if SSLv3.0 is disabled, SChannel errors occur. Otherwise, IISCrypto best practices appear to be good.

To clarify, at this time, I recommend setting IISCrypto to best practice, then enabling SSL v3.0. Unless you prefer to let SChannel error... I don't know for sure what that failure is related to yet.

I will check in again just to confirm.