How to fix Error 11233 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 11233 – Service Broker Session Key Mismatch

Why This Error Happens

This error occurs when Service Broker drops a message because the session key encryption value stored in the conversation endpoint does not match the key presented in the incoming message. This typically happens due to a corrupted or desynchronized Master Key or Service Broker certificate, or when a conversation endpoint was re-keyed (via ALTER CONVERSATION or dialog security renegotiation) on one side but the remote endpoint still holds a stale session key. It can also surface after a database restore/mirroring failover where the Service Broker GUID or certificates fell out of sync between the two SQL Server 2025 instances.

Step-by-Step Resolution Guide

Step 1: Verify Service Broker Status and Conversation Health

  • Open SQL Server Management Studio (SSMS) and run:
  SELECT is_broker_enabled, service_broker_guid FROM sys.databases WHERE name = 'YourDBName';
  • Check for orphaned or error-state conversations:
  SELECT * FROM sys.conversation_endpoints WHERE state_desc = 'ERROR';
  • Note the conversation_handle values for any endpoints showing errors.

Step 2: End and Clean Up Corrupted Conversation Endpoints

  • Terminate the broken endpoints to force a clean renegotiation on next contact:
  END CONVERSATION 'conversation_handle_guid' WITH CLEANUP;
  • Clear the Service Broker transmission queue backlog if it has grown large:
  SELECT COUNT(*) FROM sys.transmission_queue;
  • Restart the Service Broker task internally by toggling it:
  ALTER DATABASE YourDBName SET DISABLE_BROKER;
  ALTER DATABASE YourDBName SET ENABLE_BROKER;

Step 3: Re-Synchronize Master Keys and Certificates

  • On both endpoints (local and remote instance), validate the Database Master Key is open and not corrupted:
  OPEN MASTER KEY DECRYPTION BY PASSWORD = 'YourStrongPassword';
  • Re-export and re-import the Service Broker certificate on the remote instance if ALTER AUTHORIZATION or certificate rotation recently occurred:
  BACKUP CERTIFICATE BrokerCert TO FILE = 'C:\SQLCerts\BrokerCert.cer';
  • Ensure both instances reference the matching certificate thumbprint via sys.certificates.

Step 4: Restart SQL Server Service and Validate Windows Server 2025 Networking

  • Restart the SQL Server (MSSQLSERVER) service via services.msc or:
  Restart-Service -Name 'MSSQLSERVER' -Force
  • Confirm no Windows Firewall rule on Windows Server 2025/Windows 11 is intermittently resetting TCP port 4022 (default Broker endpoint port), which can cause partial handshake corruption.
  • Check Event Viewer under Applications and Services Logs > MSSQLSERVER for correlating Event ID 11233 timestamps against network drops.

Alternative or Verification Steps

  • To verify the fix, initiate a fresh test conversation using BEGIN DIALOG CONVERSATION between the two endpoints and confirm messages arrive in sys.transmission_queue without errors and the conversation reaches CONVERSING state in sys.conversation_endpoints.
  • If the mismatch persists, as a fallback, drop and recreate the Service Broker route and remote service binding entirely (DROP ROUTE / CREATE ROUTE) to force a full re-handshake of session keys rather than relying on cached certificate state.