Schannel Errors 36888 & 36876

[newpersn]

Hi all,

 

Keep getting this on one of our servers. Any ideas?

 

 

The certificate received from the remote server has not validated correctly. The error code is 0x80092013. The SSL connection request has failed.

The attached data contains the server certificate.

 

The following fatal alert was generated: 43. The internal error state is 552.

 

Server is fully patched from MS updates.

Server is running SEC, VPN NPS.

 

Thanks Newp

[newpersn]

Anyone?

[newpersn]

Anyone not had this on their servers? I got it on 2 sites, 1 2008R2 and 2012R2.

[Domino]

It means something is failing a secure channel handshake.

 

The most common cause is a duff certificate or disallowed protocol.

 

If the full event details do not list the name or IP sent, and they're happening regularly, you could wireshark the server's network connection and see which are failing.

 

That said, schannel can be a bit chatty. If you've no ill effects it might not be worth chasing.

[newpersn]

You might wanna consider removing that - it contains all the certificate details.

 

There's sophos domains listed in that text - looks like something from them is failing to handshake.

 

Thanks. Just reported my own post for that.

 

I cant see anything in the local Certs that contain sophos. Server has got the SQL database on it. But thats working fine.

[Domino]

It might not be a local cert that's tripping it, it could be the other side that's presenting it for the handshake (probable in this case)

 

The SANs offered are listed in the full details - it might point you towards what is trying to connect.

 

The most likely culprits are an out of date cert, a missing name from the SAN list, or a revoked cert (or a CRL failure).

 

Although as I've said, if it's not causing you any issues it may not be worth bothering with.