How to fix Error 9631 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 9631 — “The salt size is unacceptable for this key object”

Why This Error Happens

This error occurs when SQL Server 2025 attempts to use an encryption key (such as a Database Encryption Key, Certificate, or Symmetric Key) whose salt value does not conform to the length requirements expected by the updated cryptographic provider in this release. This is most commonly caused by keys migrated from older SQL Server versions (such as 2016 or 2019) that used legacy salt generation algorithms incompatible with the stricter FIPS-compliant validation introduced in SQL Server 2025. It can also occur if the key metadata became corrupted during a backup/restore operation or if a third-party Extensible Key Management (EKM) module is returning a malformed salt buffer.

Step-by-Step Resolution Guide

Step 1: Identify the Affected Key Object

  • Check the SQL Server Error Log located at C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\ERRORLOG to identify the specific database and key name referenced alongside Error 9631.
  • Run the following query to cross-reference encryption metadata: SELECT * FROM sys.dm_database_encryption_keys;
  • Note the encryption_state and key_algorithm columns for the flagged database.

Step 2: Regenerate the Encryption Key

  • Drop the legacy key using DROP CERTIFICATE [YourCertName]; or DROP SYMMETRIC KEY [YourKeyName]; depending on the object type flagged in Step 1.
  • Re-create the key using the modern SQL Server 2025 syntax to force a compliant salt length: CREATE CERTIFICATE [YourCertName] WITH SUBJECT = 'New Cert', START_DATE = '2025-01-01';
  • If using Transparent Data Encryption (TDE), re-encrypt the Database Encryption Key (DEK): ALTER DATABASE ENCRYPTION KEY ENCRYPTION BY SERVER CERTIFICATE [YourNewCertName];

Step 3: Update the Cryptographic Provider (If using EKM)

  • Navigate to C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Binn and verify the EKM provider DLL version matches the certified list for SQL Server 2025.
  • If outdated, download the updated provider from your HSM/EKM vendor and reinstall using an elevated PowerShell session.
  • Restart the SQL Server (MSSQLSERVER) service via services.msc or by running Restart-Service MSSQLSERVER -Force.

Step 4: Apply the Latest Cumulative Update

  • Open Windows Settings > Windows Update on Windows Server 2025 to ensure the OS cryptographic libraries (CNG) are current.
  • Download and install the latest SQL Server 2025 Cumulative Update (CU) from the Microsoft Update Catalog to patch known salt-validation bugs in the Database Engine.
  • Reboot the server to ensure the bcryptprimitives.dll and ncrypt.dll libraries are fully refreshed.

Alternative or Verification Steps

  • Verify the fix by running SELECT encryptor_type, key_length FROM sys.certificates WHERE name = 'YourCertName'; and confirm the database no longer throws Error 9631 upon the next backup or encryption scan cycle.
  • If the error persists, back up the database, restore it using the WITH REPLACE option into a sandbox instance, and attempt to re-key the encryption objects there to isolate whether the corruption is specific to the certificate or the physical database file.