How to fix Error 11253 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 11253 – Corrupted Message / Service Broker Security Header Destination Certificate

Why This Error Happens

Error 11253 occurs when SQL Server’s Service Broker encounters a corrupted or mismatched certificate during dialog security negotiation between two service instances. This typically happens due to certificate expiration, a mismatch between the public key stored in the database and the actual certificate used for encryption, or network-level packet corruption/truncation affecting the TDS stream. It can also occur if the master key used to protect the certificate is inaccessible or if the certificate was not properly synchronized between the initiator and target databases.

Step-by-Step Resolution Guide

Step 1: Verify Certificate Validity and Expiration

  • Run the following query on both the initiator and target databases to check certificate status:
  • SELECT name, expiry_date, start_date, subject FROM sys.certificates WHERE name LIKE '%ServiceBroker%';
  • Confirm that expiry_date has not passed and start_date is not in the future relative to server time.
  • Check Windows Server 2025 time synchronization settings via w32tm /query /status since clock drift between nodes can trigger certificate validation failures.

Step 2: Re-export and Re-import the Certificate Pair

  • On the initiator database, export the public key certificate:
  • BACKUP CERTIFICATE [YourCertName] TO FILE = 'C:\Certs\InitiatorCert.cer';
  • Copy the .cer file to the target server and import it into the target database using CREATE CERTIFICATE [YourCertName] FROM FILE = 'C:\Certs\InitiatorCert.cer';
  • Ensure the database master key is open on both instances using OPEN MASTER KEY DECRYPTION BY PASSWORD = 'YourStrongPassword';

Step 3: Validate Service Broker Endpoint Configuration

  • Confirm the Service Broker endpoint is using the correct authentication and encryption settings:
  • SELECT name, protocol_desc, state_desc, is_encryption_enabled FROM sys.service_broker_endpoints;
  • If encryption mismatch is suspected, temporarily set ENCRYPTION = SUPPORTED instead of REQUIRED on both endpoints to test connectivity, then revert once resolved.
  • Restart the SQL Server service via services.msc or Restart-Service MSSQLSERVER in PowerShell to force the Broker to reload certificate bindings.

Step 4: Check Network and Firewall Interference

  • Inspect Windows Defender Firewall rules on both Windows Server 2025 hosts to ensure the Service Broker port (default 4022) is not blocked.
  • Use Test-NetConnection -ComputerName TargetServer -Port 4022 in PowerShell to confirm the port is reachable and not intercepted by a proxy or load balancer that could corrupt packets.

Alternative or Verification Steps

  • To verify the fix, enable Service Broker diagnostic tracing via Extended Events (sys.dm_broker_connections and sys.transmission_queue) and confirm no new 11253 errors appear after sending a test message.
  • If the issue persists, drop and recreate the Service Broker services, routes, and remote service bindings entirely rather than reusing existing security objects, as residual metadata corruption in sys.service_contracts or sys.remote_service_bindings can also trigger this error.