We have SharePoint 2013 SP1, external resource in corporate subnet (video.domain.com) is set as a content source in SharePoint farm search service application (sharepoint.domain.com).

Ignore SSL warning is set to Yes in Search farm administration.

When trying to crawl the content source, the following error occurs:

The secure sockets layer (SSL) certificate sent by the server was invalid and this item will not be crawled. (0x80041223)

No further ULS logs are shown, even if level is set to Verbose.

I have the only one idea that due to wildcard type of certificate it is not recognized by SharePoint (see screenshot).

Wildcard certificate


This is how Chrome displays the certificate (including SAN): enter image description here

  • Is it crawling "video.domain.com" or "hostname.video.domain.com"? That wildcard isn't valid for "video.domain.com".
    – user6024
    Nov 22, 2016 at 18:17
  • Content source is set as video.domain.com but certificate is for *.video.domain.com. Certificate's SAN is: DNS Name= *.video.domain.com DNS Name=video.domain.com. According to wiki (en.wikipedia.org/wiki/Wildcard_certificate), a single wildcard certificate for *.example.com, will secure all these domains: payment.example.com contact.example.com login-secure.example.com www.example.com, which match my case.
    – Sergey
    Nov 22, 2016 at 22:02
  • I've checked certificate once more - in SAN field stated two entries: DNS Name=*.video.domain.com; DNS Name=video.domain.com Which means, according to wiki (en.wikipedia.org/wiki/Wildcard_certificate), "The "naked" domain is valid when added separately as a Subject Alternative Name (SubjectAltName): example.com". This is just my cause.
    – Sergey
    Nov 23, 2016 at 6:29

1 Answer 1


After performing some research I've found that the reason was in security protocols. Our security department has forced additional cipher suites activation on all hosts in network using group policy update but some machines were outdated. Enabling gpupdate /force on SharePoint crawl servers helped solve this issue.

Here are these suites:



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.