I am updating an existing jdbc connection which uses SSL to point to a new server. To do this I need to load a new certificate. That process appeared to go fine. Yet when updating the connection details all I get is “connection failed”.
The original connection utilized a 1024 strength cert, and had no issues. I believe I have eliminated everything but CzF and here’s whu ... after installing the cert I set up DBeaver to use the CF runtime (and thus the same keystore, etc) and with the SAME connection parameters could connect to the new database NO PROBLEM!
My belief is it is the 4096 strength that is throwing CF off.
Has anyone encountered anything like this or have any suggestions?
The platform is:
Adobe ColdFusion 2016
IIS 8.5
Windows Server 2012 R2
All have the latest patches/updates as of the time of this posting.
Thanks for any thoughts!
Forrest
I'm attempting to setup ADFS on a Windows Server 2012 R2 box that is part of a distributed setup - 1 Domain Controller, 1 Web Front End, 1 App Server (the problem box) and 1 SQL Server box.
When attempting to configure ADFS with Install-AdfsFarm I get:
“The certificates with the CNG private key are not supported. Use a
certificate based on a key pair generated by a legacy Cryptographic
Service Provider.”
The problem I have, is the exact same certificate is fine when collocating everything on a single box. It's just when I have separate servers the command fails.
How can a certificate be ok for Install-AdfsFarm on one server, but not another?
Unfortunately, ADFS 2012 R2 does not support CNG based certificates. Other versions do support these so that would explain why you are getting this error.
See: https://social.technet.microsoft.com/Forums/forefront/en-US/f0a93670-7912-4f55-b400-cc625d2f90f9/adfs-certificate-for-office-365?forum=ADFS
I've created a self-signed certificate and configured with SQL Server Express. The encryption works fine on my PC.
When I export the certificate to another PC I can import fine and can see the certificate in MMC under Personal > Certificates.
However when I try to configure with SQL Server Express on the new PC, the certificate does not appear in the dropdown.
Any suggestions?
I have tried a few things suggested on other forums
Making sure the private key is exported
Making sure the certificate was created for local system (not user)
Copy certificate into trusted certificates
Look at the properties for the certificate CN value. You will find that it has the "computer name" of the system that you created it on (which means "localhost"). This will not work when you copy the certificate to another system as the machine name will be different.
I suddenly started getting this error when trying to connect to any of my sql servers (25+) from SSMS on Windows XP. When I left work yesterday everything was working fine, came in this morning, and I started getting this. Tried rebooting my pc but that obviously didn't fix it. My co-workers can all connect just fine. Searched for a solution but everything I found was regarding encryption in regards to .NET applications. Not sure how to apply that to SSMS.
alt text http://picasaweb.google.com/lh/photo/-l9VrFuYXk-A80NzZ1kzng?feat=directlink
For some reason the image won't work so the error is this:
A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 0 - The certificate chain was issued by an authority that is not trusted.) (Microsoft SQL Server)
The question seems to have been answered, but I wanted to chime in. For some providers, such as SQL Server, there is a parameter in connection string which lets you connect to server encrypted even if certificate is unknown: "TrustServerCertificate=True", so if you include that in a connection string, you will connect and work encrypted, and will not have to run connection non-encrypted.
Try this...
Its gotta be a client issue if you lost connection to all your remote servers and your coworkers are fine. You probably got "clicky" and changed some settings inadvertantly.
Open your client network utility (mine is here: C:\WINDOWS\system32\cliconfg.exe).
Under the General Tab, check out the disabled protocols. They should all have "force protocol encryption" unchecked. If this is checked for any of those values, your local SSMS is probably trying to force an encrypted connection and failing.
Report back if this doesn't work, and I'll poke around a bit more.
When connecting using MS SQL Server Management Studio in the connect window go to Options->Connection Properties and check checkbox Trust server certificate
You connect to your SQL Servers requesting encrypted connections and you don't trust the certificate(s) used by those servers. Why that happens depends on a myriad or reasons.
Do your servers use self-signed certificates or PKI issued certificates?
Who is the PKI authorithy that issued your certificates? Is it a corporate certificate service?
Does your computer trust the PKI root authority?
If you don't know the answers to this, you must contact your network and security administrators. Simply disabling protocl enforcing requirement from your client may be against corporate policy, or the servers may enforce SSL anyway disregarding your local setting.
These are all questions you should ask your own environment admins, not public forums. You should try to solve the issue, not hack your way arround it and end up with a non-compliant machine.
From this link:
Disable client-side Force Encryption
on the server. On the machine that
runs the SQL Server instance, open up
the SQL Server Configuration Manager,
right-click SQL Native Client
Configuration, and set Force Protocol
Encryption to No. Then try connecting
locally.
http://blogs.msdn.com/sql_protocols/archive/2005/12/22/506607.aspx
I got this error, I tried to connect a remote server SQL (SaaS) in MS Cloud
I added a new firewall rule in Azure portal with my client IP that solved my issue
Open Command Prompt: press Windows Key+ R then type cmd and run
Enter this:
runas /user:[YourDomainName]\[YourActiveDirectoryUserName] /netonly cmd
Enter your active directory password and press enter
In New Command Window enter your SSMS.exe Path with double cotation like:
"C:\Program Files (x86)\Microsoft SQL Server\130\Tools\Binn\ManagementStudio\Ssms.exe"
Then login with windows athentication
I'm working with a support person who is supposed to be able to install SSL certs on a web server he maintains. He has local admin rights to the server via a domain security group. He also has permissions on our internal CA running Windows 2003 Server Certificate Authority: "Request cert" and "Issue and Manage certs".
The server he's working with is running Windows 2000 SP4 / IIS 5. When he attempts to create an online server cert the IIS wizard ends with "Failed to install. Access is Denied.". The event viewer is not working properly, so I can't find any details there. I suspect the permission issue is locally and not with the CA.
My account is a domain admin account and I know I am able to do this operation, however I need to make this work for others that are not domain admins.
Any ideas why he can't perform this operation?
I had this exact same issue a few months ago when I was setting up a cert for a client.
There's a MachineKeys folder that the Administrator need rights -
\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys
give Administrator (or the Administrator group) Full Control over this directory. I don't think you have to restart IIS, but it never hurts .
I have no idea why Admin doesn't control this as default.
Once this is changed, the Certificate Creation Wizard will successfully generate the certificate request.
I think there's even a Microsoft KB article about it somewhere.
EDIT: Here's the KB article : http://support.microsoft.com/kb/908572
-Jon
If you're renewing a certificate, then it's possible that you imported your new intermediate certificate (.pb7) before removing your existing (expired) certificate from IIS. You would get an access denied error because both the old and new certificates are for the same domain.
So by the time you get this access denied error, there are three things you must do.
Remove all certificates for this domain name from IIS, including the new one you just imported..
Go back to Console1, and remove the certificate for your domain name from Local Computer\Certificate Enrollment Requests\Certificates.
Start over.