How to fix Error 13212 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 13212 — Source Certificate Issuer Name Mismatch

Why This Error Happens

Error 13212 occurs when SQL Server 2025’s Service Broker or Database Mirroring/Always On endpoint cannot validate the issuer name embedded in the source certificate against the expected Certificate Authority (CA) chain on the remote instance. This typically happens because the certificate was generated with an incorrect AUTHORITY clause, has expired, or the issuing CA’s root certificate is missing from the Windows Server 2025 Trusted Root store. It can also surface when certificates are copied between instances without properly re-establishing the public key binding on the destination server.

Step-by-Step Resolution Guide

Step 1: Verify the Certificate Issuer Name and Expiration

  • Run the following query on the source instance to inspect certificate metadata:
  • SELECT name, issuer_name, expiry_date, start_date FROM sys.certificates;
  • Confirm the issuer_name matches exactly what the destination server expects (case-sensitive, no trailing whitespace).
  • Check that expiry_date has not passed — expired certificates will always trigger 13212 regardless of other settings.

Step 2: Re-Export and Re-Import the Certificate Correctly

  • On the source server, back up the certificate with both the public key and private key:
  • BACKUP CERTIFICATE YourCertName TO FILE = 'C:\Certs\YourCert.cer' WITH PRIVATE KEY (FILE = 'C:\Certs\YourCert.pvk', ENCRYPTION BY PASSWORD = 'StrongP@ss1');
  • Transfer both files securely to the destination server (avoid network shares with altered ACLs).
  • On the destination, create the certificate using the exact same AUTHORIZATION and issuer parameters:
  • CREATE CERTIFICATE YourCertName AUTHORIZATION [dbo] FROM FILE = 'C:\Certs\YourCert.cer' WITH PRIVATE KEY (FILE = 'C:\Certs\YourCert.pvk', DECRYPTION BY PASSWORD = 'StrongP@ss1');

Step 3: Validate the Windows Certificate Store Chain

  • Open certlm.msc on both Windows Server 2025 machines.
  • Navigate to Trusted Root Certification Authorities > Certificates and confirm the issuing CA is present and valid.
  • If using an internal PKI, re-import the Root CA chain via:
  • certutil -addstore "Root" C:\Certs\RootCA.cer
  • Restart the SQL Server service to force endpoint re-validation:
  • net stop MSSQLSERVER && net start MSSQLSERVER

Step 4: Recreate the Service Broker/Mirroring Endpoint

  • Drop and recreate the affected endpoint referencing the corrected certificate:
  • DROP ENDPOINT Endpoint_Mirroring;
  • CREATE ENDPOINT Endpoint_Mirroring STATE = STARTED AS TCP (LISTENER_PORT = 5022) FOR DATABASE_MIRRORING (AUTHENTICATION = CERTIFICATE YourCertName, ENCRYPTION = REQUIRED ALGORITHM AES);
  • Ensure port 5022 (or your custom mirroring port) is not blocked by Windows Defender Firewall.

Alternative or Verification Steps

  • Confirm resolution by querying sys.dm_exec_connections on both instances to verify the session establishes without encrypt_option errors.
  • If the issue persists, generate a fresh self-signed certificate on both ends with matching START_DATE/EXPIRY_DATE values as a clean-slate alternative, bypassing any corrupted CA chain dependencies.