How to fix Error 13184 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 13184 – Certificate Private Key Size Incompatible with Crypto Provider

Why This Error Happens

This error occurs when a certificate used by SQL Server (often for Database Mail, Service Broker, Always On, or Transparent Data Encryption) has a private key generated by the legacy Cryptographic Service Provider (CSP) that exceeds the supported key length, typically when using RSA keys larger than 2048 bits (e.g., 3072 or 4096 bits) with older CSP-based providers instead of a Key Storage Provider (KSP/CNG). SQL Server 2025, like its predecessors, relies on the Windows Cryptography API, and certain legacy CSPs cap out at 2048-bit keys, causing a mismatch when a larger key is presented. Additionally, this can happen if the certificate was imported into the wrong certificate store or generated using a CNG provider incompatible with the SQL Server service account’s cryptographic context.

Step-by-Step Resolution Guide

Step 1: Verify the Certificate’s Key Length and Provider Type

  • Open PowerShell as Administrator and run: Get-ChildItem -Path Cert:\LocalMachine\My | Format-List Subject, FriendlyName, HasPrivateKey, PublicKey
  • Check the PublicKey.Key.KeySize property; if it shows 3072 or 4096, this is likely the root cause.
  • Run certutil -store My to confirm whether the certificate uses a legacy CSP (e.g., “Microsoft RSA SChannel Cryptographic Provider”) instead of a CNG KSP (e.g., “Microsoft Software Key Storage Provider”).

Step 2: Regenerate the Certificate Using a CNG-Compatible Key Storage Provider

  • Use PowerShell’s New-SelfSignedCertificate cmdlet with the -KeyExportPolicy Exportable and explicitly specify a 2048-bit key size if legacy compatibility is required: New-SelfSignedCertificate -Subject "CN=SQLServerCert" -KeySpec KeyExchange -KeyLength 2048 -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" -CertStoreLocation Cert:\LocalMachine\My
  • If a larger key size (3072/4096) is mandatory for compliance, ensure the certificate is issued using a CNG-based provider rather than the legacy CSP.
  • Avoid using certreq.exe templates that default to legacy CSP unless the key size is capped at 2048 bits.

Step 3: Re-Bind the New Certificate to the SQL Server Service

  • Open SQL Server Configuration Manager, navigate to SQL Server Network Configuration > Protocols for [Instance Name].
  • Right-click Properties, go to the Certificate tab, and select the newly generated 2048-bit (or CNG-compatible) certificate from the dropdown.
  • Ensure the SQL Server service account has read permissions on the private key: right-click the certificate in certlm.msc, select “Manage Private Keys,” and grant Read access to the SQL Server service account (e.g., NT Service\MSSQLSERVER).
  • Restart the SQL Server service for changes to take effect: Restart-Service -Name MSSQLSERVER -Force

Step 4: Update Database Mail or Service Broker Certificate Bindings (If Applicable)

  • If the error originated from Database Mail or Service Broker, re-run the CREATE CERTIFICATE or ALTER CERTIFICATE T-SQL statements referencing the new certificate file path.
  • Example: ALTER CERTIFICATE MyCert WITH PRIVATE KEY (FILE = 'C:\Certs\NewCert.pvk', DECRYPTION BY PASSWORD = 'StrongPassword123')
  • Confirm the certificate thumbprint matches the one bound in SQL Server Configuration Manager using SELECT thumbprint FROM sys.certificates WHERE name = 'MyCert'.

Alternative or Verification Steps

  • To verify the fix, check the SQL Server Error Log and Windows Event Viewer (Application log) for Error 13184 recurrence after restarting the service; also run SELECT * FROM sys.dm_server_services to confirm the instance started cleanly.
  • If regenerating the certificate is not feasible, as a workaround, temporarily disable certificate-based encryption for the specific feature (e.g., Database Mail or Service Broker) and use a 2048-bit key certificate issued by an internal CA that explicitly supports legacy CSP compatibility.