How to fix Error 13146 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 13146 in SQL Server 2025 typically surfaces during Database Mirroring or Always On Availability Group endpoint authentication, when the TDS handshake fails to validate the digital signature presented by the remote server’s certificate. This almost always stems from an expired, revoked, or mismatched certificate on one of the partner instances, a significant clock skew between the Windows Server 2025 hosts, or the SQL Server service account lacking read permission on the private key used to sign the authentication packet. Since the signature check is a core security gate for encrypted endpoint traffic, any break in the certificate chain or trust relationship between nodes immediately throws this error and blocks the mirroring/AG session from establishing.

Step-by-Step Resolution Guide

Step 1: Verify Certificate Validity and Matching Thumbprints

  • Open SQL Server Management Studio (SSMS) on both the principal and mirror/replica instances.
  • Run SELECT * FROM sys.certificates; to confirm the certificate used by the mirroring endpoint has not expired (expiry_date column).
  • Compare the public key exported from each instance using BACKUP CERTIFICATE [CertName] TO FILE = 'C:\Certs\cert.cer'; to ensure both sides trust the same root.

Step 2: Synchronize System Clocks Between Nodes

  • On Windows Server 2025, open w32tm /query /status in an elevated PowerShell prompt to check time drift.
  • If drift exceeds 5 minutes, force a resync: w32tm /resync /force.
  • Confirm all nodes point to the same NTP source via Group Policy or w32tm /config /manualpeerlist:"time.windows.com" /syncfromflags:manual /update.

Step 3: Reassign Private Key Permissions to the SQL Service Account

  • Navigate to C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ (or ECC equivalent) where the certificate’s private key file resides.
  • Right-click the key file, select Properties > Security, and grant Read permission to the SQL Server service account (e.g., NT Service\MSSQLSERVER).
  • Restart the SQL Server service via services.msc or net stop MSSQLSERVER && net start MSSQLSERVER to reload the key context.

Step 4: Recreate the Mirroring/AG Endpoint with a Fresh Certificate

  • Drop the existing endpoint: DROP ENDPOINT [Mirroring_Endpoint];
  • Generate a new certificate pair and reissue it on both instances using CREATE CERTIFICATE with a validity window of at least 5 years to avoid near-term expiry conflicts.
  • Recreate the endpoint with CREATE ENDPOINT specifying AUTHENTICATION = CERTIFICATE [NewCertName] and restart the mirroring session.

Alternative or Verification Steps

  • After applying the fix, check the SQL Server error log and Windows Event Viewer (Application log, Event ID 13146 source) to confirm no new signature validation failures occur during the next mirroring/AG handshake attempt.
  • If the error persists, bypass certificate authentication temporarily by switching the endpoint to Windows Authentication (AUTHENTICATION = WINDOWS) to isolate whether the issue is certificate-specific or network/firewall related.