Microsoft BizTalk Server
A family of Microsoft server products that support large-scale implementation management of enterprise application integration processes.
358 questions
Master SSO Key Error - Cannot perform encryption or decryption
Leo Erlandsson
1,656
Reputation points
Hi,
Since some time we have a problem in one BizTalk 2020 (Std) environment. This hasn't occured previously with BizTalk 2016, or initially with 2020.
After Windows Patches are applied (and the server is restarted), the Master SSO Key is lost.
Restoring the Master SSO Key fixes the problem, that really shouldn't be neccessary after Windows Pathing I guess.
The following error is displayed:
"Cannot perform encryption or decryption because the secret is not available from the master secret server”
Could it be that the ESSO service is started too slow? Or is the key really corrupted by the updates?
I'm attaching screenshots of the error and the Windows updates added today.
Have anyone else experienced this? Any suggestions?
Br,
Leo
From the Event Log:
{count} votes
-
Colin Dijkgraaf 1,346 Reputation points2021-04-20T22:52:44.18+00:00 Yes, we have seen that one as well. And when BizTalk is in that state you can't make any configuration changes or stop/start ports.
It has occurred in two different environments after patching (but in different months). Try restarting Enterprise SSO on both the DB and BizTalk servers. -
Leo Erlandsson 1,656 Reputation points
2021-04-21T06:09:24.917+00:00 Thanks Colin.
Will try the restart, before actually restoring the key, next time this happens.
I'm just curious as to the cause. This has become an annoyance to a customer :)
-
Leo Erlandsson 1,656 Reputation points
2021-04-21T14:35:01.477+00:00 @Colin Dijkgraaf We patched the servers just now.
Same problem with the Master SSO Key. Restarting the ESSO Service (and the BizTalk Services) didn't work.
Only restoring the Master Key worked.The curious thing is that I compared the keys in the registry before and after the restore, and the registry looked the same
I guess we'll have to open a ticket with Microsoft.
-
Colin Dijkgraaf 1,346 Reputation points
2021-04-21T21:32:49.81+00:00 With us the option to Generate, Restore or Backup the secret was greyed out. We worked out that the SSO Server configuration on the SSO DB Server was pointing to itself, rather than pointing to the DNS name of the HA Listener. You can check that by running SO Administration on the SSO DB Server, an selecting system, and see what is in SSO Server.
-
Leo Erlandsson 1,656 Reputation points
2021-04-22T06:32:50.427+00:00 Thanks.
Restoring works fine for us. This is a one server environment, with BizTalk 2020, ESSO and SQL Server installed locally.
Will update this thread when we get an answer from Microsoft.
-
Leo Erlandsson 1,656 Reputation points
2021-05-03T13:03:24.24+00:00 Ticket opened with Microsoft Support. We got the following info so far.
We need to try to stop the services manually before applying patches.
"We strongly recommend to stop the BizTalk Services / host instances when you perform any maintenance in the BizTalk environment. Doing this, we ensure the below correct order is followed while bringing down the server.
Order of stopping the services:
1) IIS
2) Receive host instances
3) Orchestration host instances
4) Send host instances
5) Tracking host instances
6) SQL AgentYes, the reboot does stop the services but forcefully and not in the above order which might lead to corruptness of some file / key or similar issue.
"They'll also add some registry monitoring in Windows.
Sign in to comment