How to fix Error 9643 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 9643 — Service Broker/Database Mirroring Transport Manager Error

Why This Error Happens

Error 9643 typically occurs when the Service Broker or Database Mirroring endpoint fails to initialize correctly due to a TCP port conflict, certificate authentication failure, or an invalid endpoint configuration. This often happens after a Windows Server 2025 update resets firewall rules, or when the SQL Server service account lacks the correct permissions to bind to the configured endpoint port. Corrupted or expired certificates used for endpoint encryption can also trigger this transport manager failure, as can mismatched SQL Server 2025 TLS 1.3 negotiation settings between mirrored instances.

Step-by-Step Resolution Guide

Step 1: Verify the Endpoint Configuration and Status

  • Open SQL Server Management Studio (SSMS) and run:
    SELECT * FROM sys.database_mirroring_endpoints;
  • Confirm the endpoint state_desc shows STARTED and not STOPPED or DISABLED.
  • If stopped, restart it manually using:
    ALTER ENDPOINT [Mirroring_Endpoint] STATE = STARTED;

Step 2: Check for Port Conflicts and Firewall Blocking

  • Run netstat -ano | findstr <port_number> in an elevated Command Prompt (default mirroring port is often 5022).
  • Identify if another process or SQL instance is already bound to that port.
  • Open Windows Defender Firewall with Advanced Security and ensure an inbound rule exists allowing TCP traffic on the mirroring port for sqlservr.exe.
  • Re-create the firewall rule if necessary:
    New-NetFirewallRule -DisplayName "SQL Mirroring" -Direction Inbound -Protocol TCP -LocalPort 5022 -Action Allow

Step 3: Validate Certificates and Service Account Permissions

  • Navigate to C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\DATA\ (adjust version folder for SQL Server 2025) to confirm certificate files are present and not corrupted.
  • Run the following to check certificate expiration:
    SELECT name, expiry_date FROM sys.certificates;
  • Ensure the SQL Server service account has Log on as a Service rights and read access to the certificate private key via certlm.msc.
  • If certificates are expired or invalid, re-issue them using CREATE CERTIFICATE and re-bind them to the endpoint.

Step 4: Restart the SQL Server and Service Broker Services

  • Open Services.msc and restart:
  • SQL Server (MSSQLSERVER)
  • SQL Server Agent (MSSQLSERVER)
  • Alternatively, use PowerShell:
    Restart-Service -Name 'MSSQLSERVER' -Force
  • Confirm Service Broker is enabled on the database:
    SELECT is_broker_enabled FROM sys.databases WHERE name = 'YourDBName';

Alternative or Verification Steps

  • Check the SQL Server Error Log (via SSMS → Management → SQL Server Logs) for follow-up messages confirming the endpoint successfully restarted without further 9643 entries.
  • If the issue persists, drop and recreate the mirroring endpoint entirely using DROP ENDPOINT followed by a fresh CREATE ENDPOINT statement with updated certificate bindings.