You can resolve the SQL Server certificate-chain login error by adding TrustServerCertificate=True to the connection string used by your MDriven application, especially in development environments.

Recognize the error

This guidance applies when a connection reaches SQL Server but fails during login with an error such as:

A connection was successfully established with the server, but an error occurred during the login process.
The certificate chain was issued by an authority that is not trusted.

The error concerns the SQL Server certificate presented during the encrypted connection. It is not an indication that the server name or database name is necessarily incorrect.

Add TrustServerCertificate

Add TrustServerCertificate=True to the connection string.

For a connection that uses Windows integrated security, use a connection string such as:

Server=<ServerName>;Database=<dbName>;Integrated Security=True;TrustServerCertificate=True

For example:

Server=DEV-SQL01;Database=MyApplication;Integrated Security=True;TrustServerCertificate=True

This format was tested in 2024 and is intended for most development scenarios.

Choose the authentication setting

Integrated security means that SQL Server uses the Windows identity of the connecting user or service. The connection string can express this as Trusted_Connection=true or Integrated Security=True.

If you authenticate with	Use	Example
Windows integrated security	Integrated Security=True or Trusted_Connection=true	Server=DEV-SQL01;Database=MyApplication;Integrated Security=True;TrustServerCertificate=True
A SQL Server login	The login settings required for that SQL Server login; do not add Trusted_Connection=true only because it appears in an integrated-security example.	Keep TrustServerCertificate=True when the certificate-chain error is the issue.

For example, this is an integrated-security connection string:

Server=xxxx;Database=xxxx;Trusted_Connection=true;TrustServerCertificate=True

Do not copy Trusted_Connection=true into a connection string that is configured to use a SQL Server login.

Why the error can appear after an update

SQL connection 4.x changed its default encryption setting from Encrypt=False to Encrypt=True. As a result, a connection that previously worked without certificate validation can fail when SQL Server presents a certificate chain that the connecting machine does not trust.

You may also encounter connection strings that explicitly include encryption, for example:

Integrated Security=True;Encrypt=True;TrustServerCertificate=True;

When TrustServerCertificate=True is present, the connection accepts the server certificate for this connection even when its certificate chain is not trusted. Use this setting deliberately; the documented tested scenario is development.

Troubleshooting steps

1. Confirm that the error contains The certificate chain was issued by an authority that is not trusted or occurs after a connection is established but during login.
2. Find the connection string used by the MDriven application or service that is connecting to SQL Server.
3. Identify the authentication method:
   • If the connection uses Windows integrated security, retain or add Integrated Security=True or Trusted_Connection=true.
   • If the connection uses a SQL Server login, do not add an integrated-security setting from the examples on this page.
4. Add TrustServerCertificate=True to the connection string.
5. Restart or reconfigure the component that reads the connection string, then test the connection again.

Scope

This page addresses SQL Server connection certificate trust. For general SQL concepts, see Documentation:SQL. For MDriven's SQL Server persistence mapper, see Documentation:SQL Server.

See also

• Documentation:SQL
• Documentation:SQL Server
• Documentation:SQL Database
• Documentation:SQL Server change tracking
• Documentation:OCLOperators sqlpassthrough