How to fix Error 9762 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 9762 occurs when SQL Server attempts to locate a certificate referenced in its internal metadata (such as sys.certificates or master.sys.symmetric_keys) but cannot find the corresponding physical certificate file or registry entry. This typically happens after a failed certificate restore, an incomplete migration of the Service Master Key (SMK) or Database Master Key (DMK), or when the certificate was manually deleted from the Windows Certificate Store without being properly dropped from SQL Server first. Permission misconfigurations on the MSSQL\DATA folder or the Windows Certificate Store can also prevent the Database Engine service account from reading the certificate.

Step-by-Step Resolution Guide

Step 1: Verify Certificate Existence in SQL Server Metadata

  • Open SSMS and connect to the affected instance.
  • Run SELECT name, pvt_key_encryption_type_desc, thumbprint FROM sys.certificates; against the relevant database (often master or a user database).
  • Cross-reference the thumbprint returned with certificates exported during your last backup cycle.

Step 2: Check the Physical Certificate File Location

  • Navigate to the default backup path: C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\DATA\
  • Confirm the .cer and .pvk files referenced during the original CREATE CERTIFICATE statement still exist.
  • If missing, locate your most recent certificate backup file (usually named CertName_YYYYMMDD.cer and CertName_YYYYMMDD.pvk).

Step 3: Restore the Certificate from Backup

  • Run the following T-SQL command, adjusting paths and password accordingly:
CREATE CERTIFICATE YourCertName
    FROM FILE = 'C:\Backups\YourCertName.cer'
    WITH PRIVATE KEY (
        FILE = 'C:\Backups\YourCertName.pvk',
        DECRYPTION BY PASSWORD = 'YourStrongPassword123!'
    );
  • If the certificate was tied to TDE, re-run ALTER DATABASE YourDB SET ENCRYPTION ON; after restoration to re-link it.

Step 4: Validate Service Account Permissions

  • Open Services.msc on Windows Server 2025 and confirm the SQL Server service account (e.g., NT Service\MSSQLSERVER) has Read access to the MSSQL\DATA directory.
  • Right-click the folder → Properties → Security tab → add the service account with Read & Execute permissions if missing.

Step 5: Restart the SQL Server Service

  • Open SQL Server Configuration Manager.
  • Right-click the SQL Server (MSSQLSERVER) instance and select Restart to force SQL Server to re-cache certificate metadata.

Alternative or Verification Steps

  • After restarting, re-run SELECT * FROM sys.dm_server_registry WHERE value_name LIKE '%Certificate%'; to confirm SQL Server now recognizes the certificate thumbprint without throwing Error 9762.
  • If no valid backup certificate exists, you may need to generate a brand-new certificate using CREATE CERTIFICATE and re-encrypt any dependent objects (backups, column encryption keys, or TDE databases), though this will invalidate any previously encrypted backups tied to the old certificate.