How to fix Error 3278 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3278 – “Failed to encrypt string %ls”

Why This Error Happens

Error 3278 occurs when SQL Server’s encryption subsystem fails to encrypt a string value, typically during backup encryption, Always Encrypted operations, or certificate-based encryption tasks. The most common root causes are a corrupted or inaccessible encryption certificate/key, insufficient permissions on the certificate’s private key file, or a mismatch between the algorithm specified and what the certificate/key supports. This can also surface when the Master Key or Service Master Key is not properly decrypted due to Windows DPAPI issues following a server migration or OS upgrade to Windows Server 2025.

Step-by-Step Resolution Guide

Step 1: Verify the Certificate or Key Used for Encryption

  • Run SELECT * FROM sys.certificates; to confirm the certificate exists and is not expired.
  • Check sys.symmetric_keys or sys.asymmetric_keys if using key-based encryption instead of certificates.
  • Look for a null or outdated pvt_key_last_backup_date which may indicate key corruption.

Step 2: Check File System Permissions on Key Material

  • Navigate to the certificate export path (commonly C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\DATA\ or a custom backup folder).
  • Ensure the SQL Server service account has explicit Read and Write permissions on any .pvk or .cer files referenced.
  • Use icacls "C:\path\to\certificate.pvk" /grant "NT SERVICE\MSSQLSERVER":(R,W) to reset permissions if needed.

Step 3: Re-encrypt or Restore the Database Master Key

  • Open SSMS and run OPEN MASTER KEY DECRYPTION BY PASSWORD = 'YourStrongPassword';
  • If the key is missing or corrupted, restore it using RESTORE MASTER KEY FROM FILE = 'C:\Backup\MasterKey.key' DECRYPTION BY PASSWORD = 'OldPassword' ENCRYPTION BY PASSWORD = 'NewPassword';
  • Re-run the original encryption command (e.g., BACKUP CERTIFICATE, ENCRYPTBYCERT, or ALTER COLUMN ENCRYPTION KEY) that triggered Error 3278.

Step 4: Validate Algorithm Compatibility

  • Confirm the encryption algorithm (e.g., AES_256) matches what the target certificate or column encryption key supports.
  • For Always Encrypted columns, verify the Column Master Key settings in SSMS under Security > Always Encrypted Keys.
  • Update the T-SQL statement to use a supported algorithm if a mismatch is found.

Step 5: Restart SQL Server Service and Clear Cache

  • Restart the SQL Server (MSSQLSERVER) service via services.msc or net stop MSSQLSERVER && net start MSSQLSERVER.
  • This clears any cached key handles that may have become invalid after a Windows Server 2025 update.

Alternative or Verification Steps

  • Verify the fix by re-executing the failed encryption operation (backup, column encryption, or ENCRYPTBYCERT call) and confirming no error 3278 is thrown in the SQL Server Error Log.
  • If the issue persists, drop and recreate the certificate/key pair entirely using CREATE CERTIFICATE with a fresh private key, then re-associate it with the affected database objects.