Sitecore 9.3 Installing on Windows 11 returns "certificate chain was issued by an authority that is not trusted." error

Question

I know some people's first thoughts will be Sitecore 9.3 is not supported on Windows 11 per their documentation. And that is fair but it can be done and can still work.

However, there are a few challenges. The installation does not work out of the box because Windows 11 have started to enforce a security change Microsoft has rolled out. This change makes connections to the SQL server default to use encrypted connections. This means some of the Powershell scripts in the install error with this error.

A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - The certificate chain was issued by an authority that is not trusted.)

It errors because the cert is self-signed and is not fully trusted. So is there a way to address this so the installs run?

Answer 1

I have been working through this and found the solution. But I wanted to post the write-up here so others can find it in the future.

The main issue on why this errors comes the xConnect scripts in the sitecore-XP0.json file. There are 4 InvokeSqlcmd configured in this json file that look like this.

            "Description": "Create Collection Shard Database Server Login.",
            "Type": "InvokeSqlcmd",
            "Params": {
                "ServerInstance": "[parameter('SqlServer')]",
                "Credential": "[variable('Sql.Credential')]",
                "InputFile": "[variable('Sharding.SqlCmd.Path.CreateShardApplicationDatabaseServerLogin')]",
                "Variable": [
                    "[concat('UserName=',variable('SqlCollection.User'))]",
                    "[concat('Password=',variable('SqlCollection.Password'))]"
                ]
            },
            "Skip": "[parameter('SkipDatabaseInstallation')]"

Normally these work fine. Except now with Windows 11 these call default to using an encrypted connection to SQL. This means it is using a self-signed cert that is not going to be trusted. So is there a way we can make these calls not need the cert? There sure is. We just need to use "TrustServerCertificate": true. So we need to update each of the 4 calls to look like this (this is the update to one of them they all don't need to look like this they all just need to have "TrustServerCertificate": true, added to them.

            "Description": "Create Collection Shard Database Server Login.",
            "Type": "InvokeSqlcmd",
            "Params": {
                "ServerInstance": "[parameter('SqlServer')]",
                "TrustServerCertificate": true,
                "Credential": "[variable('Sql.Credential')]",
                "InputFile": "[variable('Sharding.SqlCmd.Path.CreateShardApplicationDatabaseServerLogin')]",
                "Variable": [
                    "[concat('UserName=',variable('SqlCollection.User'))]",
                    "[concat('Password=',variable('SqlCollection.Password'))]"
                ]
            },
            "Skip": "[parameter('SkipDatabaseInstallation')]"

Notice the minor but very important change here of the additional params item. Once you add this your installation will work.

There are a couple more issues you may run into and I will link their solutions here as well to make it easier.

1. Marketing service will not start
2. ERR_SSL_KEY_USAGE_INCOMPATIBLE

Answer 2

For installing Sitecore 10.3 I was getting similar error as shown below :

The solution is to add "TrustServerCertificate": true, in 4 places in xconnect-xp0.json (and in 1 place in sitecore-XPO.json if you are using Azure SQL ) as shown below :

Also, in SSMS check the Trust server certificate checkbox

Answer 3

This issue occurs even for Windows 10 Sitecore v9.3, solution mentioned adding "TrustServerCertificate": true, in 4 places in xconnect-xp0.jsonshould resolve the issue.

Answer 4

If you facing a similar issue for a Sitecore 10.3 XP1 Scaled instance. Search for the keyword InvokeSqlcmd in the json file xconnect-xp1-collection.json set "TrustServerCertificate": true at 4 places and in json file xconnect-xp1-cm.json make the same change at 1 place.