How to fix Error 13118 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 13118 is triggered within the Always On Availability Groups (AG) subsystem when a replica attempts to establish a database mirroring endpoint connection but fails due to a mismatch in certificate authentication, an expired certificate, or a blocked communication port between the primary and secondary replicas. This typically occurs after a certificate rotation, a Windows Server 2025 security policy update, or a firewall rule change that silently blocks the default mirroring endpoint port (5022). In some cases, the error also surfaces when the SQL Server service account lacks CONNECT permission on the endpoint itself, preventing the replica handshake from completing.

Step-by-Step Resolution Guide

Step 1: Verify Endpoint Status and Configuration

  • Open SQL Server Management Studio (SSMS) and connect to each replica instance.
  • Run the following query to confirm the endpoint is started: SELECT name, state_desc, port FROM sys.tcp_endpoints WHERE type_desc = 'DATABASE_MIRRORING';
  • If state_desc returns STOPPED, restart it with: ALTER ENDPOINT [Hadr_endpoint] STATE = STARTED;

Step 2: Validate Certificate or Authentication Settings

  • Check whether the endpoint uses certificate-based authentication: SELECT name, certificate_id FROM sys.database_mirroring_endpoints;
  • Confirm the certificate has not expired by querying sys.certificates on both the primary and secondary replicas.
  • If expired, re-issue the certificate and re-establish trust using CREATE CERTIFICATE and ALTER ENDPOINT ... AS TCP (CERTIFICATE = ...) on all nodes.

Step 3: Check Firewall and Network Port Access

  • On Windows Server 2025 / Windows 11, open Windows Defender Firewall with Advanced Security.
  • Create or verify an inbound rule allowing TCP port 5022 (or your custom mirroring port) for the sqlservr.exe process.
  • Test connectivity between nodes using: Test-NetConnection -ComputerName <ReplicaServerName> -Port 5022

Step 4: Grant Required Permissions on the Endpoint

  • Ensure the SQL Server service account (or AG login) has CONNECT permission:
  • GRANT CONNECT ON ENDPOINT::[Hadr_endpoint] TO [DOMAIN\SQLServiceAccount];
  • Restart the SQL Server service on the affected node via services.msc or Restart-Service MSSQLSERVER in PowerShell.

Step 5: Rejoin the Replica to the Availability Group

  • If the connection still fails, remove and re-add the problematic replica using the Always On Availability Groups wizard in SSMS.
  • Confirm synchronization health afterward in the Always On High Availability dashboard.

Alternative or Verification Steps

  • Verify the fix by checking the SQL Server Error Log and Windows Event Viewer (Application log) for the recurrence of Event ID 13118; a clean log after restart confirms resolution.
  • As an alternative, use DBCC CHECKDB and sys.dm_hadr_availability_replica_states to confirm all replicas report CONNECTED and HEALTHY status after applying the above steps.