Schannell: Certificate received from the remote server was issued by an untrusted certificate authority i'm not sure whether to ask this on ServerFault or here.

Periodically following error is logged in Windows Server 2008 Administrative events:


  The certificate received from the remote server was issued by an
  untrusted certificate authority. Because of this, none of the data
  contained in the certificate can be validated. The SSL connection
  request has failed. The attached data contains the server certificate.


Log Name: System
Source: Schannel


Followed by:


  The following fatal alert was generated: 48. The internal error state
  is 552.


Log Name: System
Source: Schannel


If i change the Force Encryption property in SQL-Server Configuration from "No" to "Yes"(see image below) the error would not be logged anymore. 



But i don't really need SSL-Encryption since all connections are trusted(from intranet) and ports 1333 and 1334 are firewalled from internet.

Would it be a performance impact if i would force encryption and generate a server certificate, is it recommended at all in my situation? I don't want to enforce encryption only to prevent from some event logs if it not even causes serious connection problems(where can i see which connection has caused it?).

Q: Can somebody please explain why these errors are raised and wherefrom?
You're getting those errors because something is trying to connect to SQL Server via SSL, and you don't have a real (signed) certificate trusted by all parties involved.

By setting "Force Encryption" to Yes, you won't make the errors go away - actually, the opposite. You'll make the errors happen everywhere, because you're not fixing the root problem. Right now, only a few things are trying to connect via SSL, but you're about to make EVERYTHING connect via SSL, which means everything will throw those errors. Bad idea.

Instead, track down what's trying to connect via SSL. If it's happening at the same date/time every time, you can set up a trace, or figure out what servers are running batch jobs. Then, THAT server is the one that needs a real cert (as well as the SQL Server) - or just change that application's settings so that it's not trying to connect with SSL.