0

I have set up a SQL Server database server on my Ubuntu 16 machine. To make it secure over a host network I am working on adding an SSL encryption certificate on it.

I tried following the steps as mentioned on this link ssl-encryption-mssql

But after restarting the service of SQL Server, it breaks giving the below exit code status

code=exited, status=1/FAILURE

I even tried to check the logs using journalctl -u mssql-server.service -b but it is not helpful at all. For the referrence, I am adding the screenshot of journalctl command below:

output of journalctl

My /var/opt/mssql/mssql.conf looks something like this after following the steps from official doc.

[sqlagent]
enabled = false

[EULA]
accepteula = Y

[network]
tlscert = /etc/ssl/certs/cert.pem
tlskey = /etc/ssl/private/privkey.pem
tlsprotocols = 1.2
forceencryption = 1

EDIT-1: I further checked out the logs from /var/log/syslog, it stated the following log- Error: 49940, Severity: 16, State: 1.Unable to open one or more of the user-specified certificate file(s). Verify that the certificate file(s) exist with read permissions for the user and group running SQL Server and found this question which seems similar, I tried the approach as told by Charles but it doesn't seem to work. Even I am using the Let's Encrypt Certificates.

EDIT-2: It is not a licensed version, could this be the reason?

How to resolve this error?

1 Answer 1

1

I just faced the same problem even though I followed the same steps as mentioned in the microsoft documentation. The actual problem seems to be with the permissions on the folder paths where the certificate files are located.

You can verify whether mssql user is able to connect or not using the openssl commands.

This command will do a basic verification on whether the certificates are valid or not.

sudo su - mssql -c "openssl verify -verbose -CAfile /etc/ssl/certs/mssql_ca.pem /etc/ssl/certs/cert.pem"

If you wanted to see if the combination of certificates are actually working or not (with key), you can start a openssl server service and then connect to it with another openssl client connection.

sudo su - mssql -c "openssl s_server -accept 8443 -cert /etc/ssl/certs/cert.pem -key /etc/ssl/private/privkeyrsa.pem -CAfile /etc/ssl/certs/mssql_ca.pem"

openssl s_client -connect localhost:8443

Another small correction from the documentation (I am using CA provided certificate), had to convert the key file format (might not require for you).

openssl rsa -in /etc/ssl/private/key.pem -out /etc/ssl/private/privkeyrsa.pem

2
  • Thanks, I will try this.
    – john mich
    Oct 14, 2019 at 16:38
  • for me this fixed it: sudo chown mssql:mssql /etc/ssl/private
    – busytools
    Jul 29, 2022 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.