Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Change from built in account to domain user for sql services causes SSl cert error

Posted on 2010-11-28
5
Medium Priority
?
479 Views
Last Modified: 2012-06-27
All,

Have recently run through a program of creating defined SQL domain accounts to stop using the built in ones.

All has gone fine, except in multiple machines i get the below error

A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x80090016.

Im guessing this is due to the new domain user account not having access to the old SSL certs, I have linked them through SQL config manager>> protocols but the error still occurs.

is there any way i can give the new domain user rights to these certs, or if not are we ok to use the self generated certificates?

All help appreciated
0
Comment
Question by:slam69
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 12

Expert Comment

by:ill
ID: 34228397
try
1. logon on to desktop as sql service domain user
2. insert certificate as logged-in user
0
 
LVL 25

Author Comment

by:slam69
ID: 34229043
Ok,

im stuck at home with a bug now today so will try this when im back in teh office and let you know
0
 
LVL 25

Author Comment

by:slam69
ID: 34231760
hi ill, ok logged in as service user account and unless i give it local admin rights it wont find the cert, this is against what i want to do.

the cert says it comes with a private key so how best to give it teh certificacte without giving it local admin rights?

Many Thanks
0
 
LVL 12

Expert Comment

by:ill
ID: 34236547
I thought once you have the cert key cached for the account , you can remove the admin rights.
If the cert is downloaded each time you may try to:
1. use SQL proxy account or
2. set security on a box to allow non-admin user to write to directory where cert are stored
0
 
LVL 25

Accepted Solution

by:
slam69 earned 0 total points
ID: 34266181
Hi I had to use part of the 2003 tool kit which has an app that allows you to permission individual certificates in teh machine store for non -admin users. you do this through the command line and worked like a charm
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

by Mark Wills Attending one of Rob Farley's seminars the other day, I heard the phrase "The Accidental DBA" and fell in love with it. It got me thinking about the plight of the newcomer to SQL Server...  So if you are the accidental DBA, or, simp…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This course is ideal for IT System Administrators working with VMware vSphere and its associated products in their company infrastructure. This course teaches you how to install and maintain this virtualization technology to store data, prevent vuln…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question