How to fix Error 9630 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 9630 — “The Signature Did Not Verify the Internal Hash”

Why This Error Happens

This error occurs when SQL Server 2025 detects that a signed module, certificate, or database object (such as a stored procedure, assembly, or backup signature) has an internal hash mismatch, indicating the signed content has been altered, corrupted, or tampered with after signing. This is commonly triggered by incomplete disk writes, antivirus interference during file operations, improper migration of signed objects between servers, or corruption in the master database’s metadata tables that store signature information. It can also occur if the certificate or asymmetric key used to validate the signature has been modified, re-issued, or is out of sync with the original signing key.

Step-by-Step Resolution Guide

Step 1: Verify the Integrity of the Affected Database and Objects

  • Run DBCC CHECKDB ('YourDatabaseName') WITH NO_INFOMSGS, ALL_ERRORMSGS; to rule out underlying page-level corruption.
  • Check the SQL Server error log (default path: C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\ERRORLOG) for the exact object name tied to Error 9630.
  • Identify whether the issue is tied to a specific signed stored procedure, CLR assembly, or backup set.

Step 2: Re-Validate or Re-Sign the Certificate/Key Pair

  • Query sys.certificates and sys.crypt_properties to confirm the certificate thumbprint matches what was originally used to sign the object: 
  SELECT * FROM sys.crypt_properties;
  SELECT * FROM sys.certificates;
  • If the certificate appears altered or missing, drop the existing signature using DROP SIGNATURE and re-apply it with ADD SIGNATURE TO <object_name> BY CERTIFICATE <cert_name> WITH PASSWORD = '<StrongPassword>';
  • Ensure the certificate private key file (.pvk) and public key (.cer) used for signing have not been modified since original deployment.

Step 3: Restore from a Known-Good Backup or Re-Deploy the Signed Module

  • If re-signing fails, restore the affected database or object from the last verified clean backup using RESTORE DATABASE YourDatabaseName FROM DISK = 'D:\Backups\YourDatabaseName.bak' WITH REPLACE;
  • For CLR assemblies, re-deploy the original .dll from source using CREATE ASSEMBLY with the WITH PERMISSION_SET = SAFE clause, then re-sign it.
  • Confirm no third-party antivirus or Windows Defender real-time scanning is quarantining or modifying .mdf, .ldf, or assembly files in the SQL Server data directory (C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\DATA\).

Step 4: Check Windows Server 2025 / Windows 11 Security Policies

  • Open Local Security Policy (secpol.msc) and verify that System cryptography: Use FIPS compliant algorithms is not misconfigured, as this can interfere with SQL Server’s internal signature validation.
  • Confirm the SQL Server service account has full read/write access to the certificate store (certlm.msc under Local Computer > Personal).

Alternative or Verification Steps

  • After applying fixes, run EXEC sys.sp_verify_database_ownership; or re-execute the originally failing operation (e.g., restore, procedure execution) to confirm Error 9630 no longer appears in the error log.
  • If the issue persists, use sqlcmd -S localhost -Q "DBCC CHECKDB" from an elevated PowerShell terminal to isolate whether the corruption is OS-level (NTFS) rather than SQL Server-specific, and run chkdsk C: /f /r on the next reboot cycle.