Sql Server 无法看到我的证书
我需要在外部供应商和我的公司之间安装用于加密（复制）的证书。
我无法获得服务器 FQDN 的第三方证书，因为该网络部分与我们拥有的域不匹配（即我的 FQDN 是 sqlservername.company.root.net，但我们不拥有名为 company 的域。 root.net。）。我们确实拥有 mycompany.com，因此我在证书上获得了 sqlserver.mycompany.com，并且有一个将 sqlserver.mycompany.com 别名为 sqlservername.company.root.net 的 DNS 条目。
我无法使用自行生成的证书，因为供应商需要信任证书颁发机构。
我已购买并安装了证书，但 SQL Server 不会看到它，因为 FQDN 不匹配。
我尝试通过将证书的指纹直接放入注册表来安装它，但是 SQL Server 将无法启动并出现以下错误：
服务器无法加载启动 SSL 连接所需的证书。它返回以下错误：0x8009030e。检查证书以确保它们有效。
无法加载用户指定的证书 [证书哈希(sha1)“xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”]。服务器将不接受连接。您应该验证证书是否已正确安装。请参阅联机丛书中的“配置 SSL 使用的证书”。
（其中上面的 x 与证书的指纹匹配，不带空格）
TDSSNIClient 初始化失败，错误为 0x80092004，状态代码为 0x80。原因：无法初始化 SSL 支持。找不到对象或属性。
我需要做哪些不同的事情才能使其正常工作？
I need to install a certificate for encryption (replication) between an external vendor and my company.
I cannot get a third party certificate for the FQDN of my server because the net part of that does not match a domain that we own (ie my FQDN is sqlservername.company.root.net but we don't own a domain called company.root.net.). We do own mycompany.com, so I got sqlserver.mycompany.com on the cert and have a DNS entry to alias sqlserver.mycompany.com to sqlservername.company.root.net.
I cannot use a self generated cert since the vendor needs to trust the cert authority.
I have a cert that I have purchased and installed, but SQL Server won't see it since the FQDN doesn't match.
I tried installing it by putting the thumbprint of the cert into the registry directly, but then SQL server won't start with the following errors:
The server could not load the certificate it needs to initiate an SSL connection. It returned the following error: 0x8009030e. Check certificates to make sure they are valid.
Unable to load user-specified certificate [Cert Hash(sha1) "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"]. The server will not accept a connection. You should verify that the certificate is correctly installed. See "Configuring Certificate for Use by SSL" in Books Online.
(where the x's above match the thumbprint of the cert without spaces)
TDSSNIClient initialization failed with error 0x80092004, status code 0x80. Reason: Unable to initialize SSL support. Cannot find object or property.
What do I need to do differently to get this working?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您需要使用 MMC 在证书存储中安装证书，然后使用 SQL Server 配置管理器将证书链接到 SQL Server 服务。请参阅https://support.microsoft.com/en-us/help/316898/how-to-enable-ssl-encryption-for-an-instance-of-sql-server-by-using-mi
然后，确保运行 SQL Server 服务的服务帐户对该证书具有完全权限。在 MMC 中，右键单击证书，选择“管理私钥”，然后授予对运行 SQL Server 的服务帐户的完全访问权限。
您应该重新启动 SQL Server 以使更改生效。
You need to use MMC to install your certificate in the certificate store and then use the SQL Server Configuration Manager to link the certificate to your SQL Server service. See https://support.microsoft.com/en-us/help/316898/how-to-enable-ssl-encryption-for-an-instance-of-sql-server-by-using-mi
Then, make sure that the service-account running you SQL Server service has full permission on the certificate. In MMC, right-click on the certificate, select Manage private key, and then grant full access to the service-account running you SQL Server.
You should restart your SQL Server for the changes to take effect.
首先，您必须在 Windows 证书信任库中安装证书。
你这样做了吗？
错误
似乎表明您没有执行此操作。
我期望主机名验证是可配置的，但是从这里 MS-SQL2008 r2 中的 SSL 这似乎是一个绝对的要求。
老实说，我不确定您对 DNS 条目所做的技巧是否有效。
看来一些调整适用于集群安装 用于集群安装的 ssl
对于您的情况，您可能应该使用 IP 作为主题名称购买证书，并使用 DNS 解析为您所说的 FQDN。
但当然，这意味着使用静态 IP，而且很可能无论如何也不可行......
Before anything else, you must install the certificate in the Windows certificate truststore.
Did you do that?
The error
seems to indicate you did not do this.
I was expecting that the hostname verification would be configurable but from here SSL in MS-SQL2008 r2 it seems as an absolute requirement.
To be honest I am not sure if the trick you did with the DNS entry will work.
It seems that some tweeking works for cluster installations ssl for cluster installations
In your case, may be you should have bought the certificate using the IP as subject name and use DNS to resolve to the FQDN you say.
But of course this implies use of a static IP and most likely it would not be feasible as well anyway.....