Solved

Change from built in account to domain user for sql services causes SSl cert error

Posted on 2010-11-28
5
474 Views
Last Modified: 2012-06-27
All,

Have recently run through a program of creating defined SQL domain accounts to stop using the built in ones.

All has gone fine, except in multiple machines i get the below error

A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x80090016.

Im guessing this is due to the new domain user account not having access to the old SSL certs, I have linked them through SQL config manager>> protocols but the error still occurs.

is there any way i can give the new domain user rights to these certs, or if not are we ok to use the self generated certificates?

All help appreciated
0
Comment
Question by:slam69
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 12

Expert Comment

by:ill
ID: 34228397
try
1. logon on to desktop as sql service domain user
2. insert certificate as logged-in user
0
 
LVL 25

Author Comment

by:slam69
ID: 34229043
Ok,

im stuck at home with a bug now today so will try this when im back in teh office and let you know
0
 
LVL 25

Author Comment

by:slam69
ID: 34231760
hi ill, ok logged in as service user account and unless i give it local admin rights it wont find the cert, this is against what i want to do.

the cert says it comes with a private key so how best to give it teh certificacte without giving it local admin rights?

Many Thanks
0
 
LVL 12

Expert Comment

by:ill
ID: 34236547
I thought once you have the cert key cached for the account , you can remove the admin rights.
If the cert is downloaded each time you may try to:
1. use SQL proxy account or
2. set security on a box to allow non-admin user to write to directory where cert are stored
0
 
LVL 25

Accepted Solution

by:
slam69 earned 0 total points
ID: 34266181
Hi I had to use part of the 2003 tool kit which has an app that allows you to permission individual certificates in teh machine store for non -admin users. you do this through the command line and worked like a charm
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

In this article I will describe the Copy Database Wizard method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
Since pre-biblical times, humans have sought ways to keep secrets, and share the secrets selectively.  This article explores the ways PHP can be used to hide and encrypt information.
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question