How to fix Error 11232 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 11232 – “Conversation Endpoint Is Secured”

Why This Error Happens

This error occurs when a Service Broker conversation attempts to send a message over an endpoint that requires encryption or certificate-based authentication, but the local or remote database lacks a valid, matching certificate for secure dialog. It commonly arises after a certificate expires, is deleted, or was never properly backed up and restored on both ends of the conversation. Additionally, mismatched ENCRYPTION settings on the CREATE REMOTE SERVICE BINDING or missing master key configurations on either the initiator or target database can trigger this failure.

Step-by-Step Resolution Guide

Step 1: Verify the Database Master Key and Certificates

  • Confirm a Database Master Key (DMK) exists in both the initiating and target databases by running SELECT * FROM sys.symmetric_keys WHERE name = '##MS_DatabaseMasterKey##';.
  • If missing, create one using CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'StrongPassword123!';.
  • Check for an existing Service Broker certificate with SELECT * FROM sys.certificates; and confirm expiration dates are valid.

Step 2: Re-Issue or Restore the Service Broker Certificate

  • If the certificate is expired or missing, generate a new one using CREATE CERTIFICATE SB_Cert WITH SUBJECT = 'Service Broker Certificate', START_DATE = 'mm/dd/yyyy', EXPIRY_DATE = 'mm/dd/yyyy';.
  • Back up the certificate using BACKUP CERTIFICATE SB_Cert TO FILE = 'C:\SQLCerts\SB_Cert.cer'; and securely transfer it to the partner server.
  • On the remote server, restore the certificate using CREATE CERTIFICATE SB_Cert FROM FILE = 'C:\SQLCerts\SB_Cert.cer'; under the correct user mapped to the Service Broker.

Step 3: Validate Remote Service Binding and Encryption Settings

  • Review the remote service binding configuration with SELECT * FROM sys.remote_service_bindings;.
  • Ensure the ENCRYPTION option matches on both ends — use ENCRYPTION = REQUIRED or ENCRYPTION = OPTIONAL consistently across both the initiator and target bindings.
  • If needed, drop and recreate the binding using CREATE REMOTE SERVICE BINDING SB_Binding TO SERVICE 'TargetServiceName' WITH USER = SB_User, ENCRYPTION = REQUIRED;.

Step 4: Restart the Service Broker and Flush Cached Conversations

  • Disable and re-enable Service Broker on the affected database using ALTER DATABASE [YourDB] SET DISABLE_BROKER; followed by ALTER DATABASE [YourDB] SET ENABLE_BROKER;.
  • Clear any stuck conversation endpoints by querying sys.conversation_endpoints and ending stalled dialogs with END CONVERSATION 'conversation_handle' WITH CLEANUP;.

Alternative or Verification Steps

  • Send a test message through the Service Broker queue and confirm successful delivery by checking sys.transmission_queue for an empty or NULL transmission_status column.
  • If the issue persists, temporarily set ENCRYPTION = OPTIONAL on both endpoints as a diagnostic step to confirm whether certificate mismatch—rather than network or firewall issues—is the root cause.