Mendix 10.24.20 On-Premise Deployment Fails to Start Due to JDBC/SSL Connection Error (Mendix 9.x Apps Working Fine)

0
Hello Community,We are currently porting an application from Mendix 9 to Mendix 10.24.20 and deploying it in our on-premise Mendix Service Console environment.Environment DetailsMendix Version: 10.24.20Deployment Type: On-Premise (Mendix Service Console)Database: Microsoft SQL ServerJava Version: Java 21 (used by Mendix 10 runtime)Authentication: SQL User AuthenticationExisting Mendix 9.24.x applications are running successfully on the same server and using the same SQL Server environment.IssueThe service fails while starting and cannot establish a database connection.The error shown in the Mendix Service Console isOpening JDBC connection failed with SQLState: 08S01.The "encrypt" property is set to "true" and"trustServerCertificate" property is set to "false"but the driver could not establish a secure connection to SQL Server.PKIX path building failed:sun.security.provider.certpath.SunCertPathBuilderException:unable to find a valid certification path to requested targetWhat We Have ObservedMendix 9.24.x applications are running successfully on the same server.The database server is reachable.SQL credentials are correct.The issue appears only with the Mendix 10.24.20 deployment.In Studio Pro, the SSL Certificate Algorithm is currently set to PKIX (recommended).We suspect the issue may be related to the newer JDBC driver or stricter SSL certificate validation in Mendix 10 / Java 21.Any guidance, documentation references, or recommended troubleshooting steps would be greatly appreciated.Has there been any database connection or JDBC configuration change in Mendix 10.24.20 compared to Mendix 9.x? If yes, where should the updated connection string or SSL settings be configured in an on-premise deployment?Attachment: Screenshot of the Mendix Service Console error log.
asked
1 answers
0

Root Cause

Based on the error message, this is not a SQL authentication issue but an SSL/TLS certificate trust issue between the Mendix 10 runtime (Java 21) and SQL Server.


PKIX path building failed:

sun.security.provider.certpath.SunCertPathBuilderException:

unable to find a valid certification path to requested target


This means the SQL Server JDBC driver is attempting to establish an encrypted connection, but the certificate presented by SQL Server is not trusted by the Java truststore being used by the Mendix 10 runtime.

Why It Works in Mendix 9 but Fails in Mendix 10

Mendix 10 runs on a newer Java runtime (Java 21) and newer JDBC driver versions, which enforce stricter SSL/TLS certificate validation. As a result, environments that worked in Mendix 9 may start failing if SQL Server is using:

  • A self-signed certificate
  • An internally issued certificate not trusted by Java
  • An expired or incorrectly configured SQL Server certificate

This behavior is consistent with Microsoft SQL Server JDBC encryption requirements when:


encrypt=true

trustServerCertificate=false


The driver must validate the SQL Server certificate against a trusted CA chain.

Recommended Resolution (Production)

The preferred solution is to trust the SQL Server certificate in Mendix Runtime.

  1. Export the SQL Server certificate (or Root CA certificate).
  2. Copy it to the Mendix server.
  3. In Mendix Service Console, add a custom runtime setting:


CACertificates=C:\Certificates\sqlserver.crt


  1. Restart the Mendix application.

This allows the runtime to validate the SQL Server certificate correctly while maintaining encrypted communication.

Temporary Workaround (Development/Test Only)

If the SQL Server certificate is self-signed and certificate validation is not required, modify the JDBC URL to:


jdbc:sqlserver://<server>;

databaseName=<database>;

encrypt=true;

trustServerCertificate=true;


This keeps encryption enabled but skips certificate chain validation. Use this only in non-production environments.

Alternative Option

If your organization's security policy permits disabling database encryption:


encrypt=false


or


DatabaseUseSsl=false


However, this is generally not recommended for production deployments.

Where to Configure This in On-Premise Mendix Service Console

For on-premise deployments, the settings can be configured in:

Mendix Service Console → Configuration → Advanced

Relevant settings:


DatabaseJdbcUrl

CACertificates

DatabaseUseSsl


The JDBC URL can be overridden there if additional SQL Server SSL parameters are required.

Suggested Verification

Before making changes, verify:

  1. Whether SQL Server is using a self-signed certificate.
  2. Whether "Force Encryption" is enabled on the SQL Server instance.
  3. Whether the certificate CN/SAN matches the hostname used in the JDBC connection.
  4. Whether the certificate chain is trusted by the Java 21 runtime.

Conclusion

There is no major database configuration change required in Mendix 10.24.20 itself. The issue is typically caused by the newer Java/JDBC stack enforcing stricter SSL certificate validation. Importing the SQL Server certificate (or Root CA certificate) into the Mendix runtime trust configuration is the recommended long-term fix, while trustServerCertificate=true can be used as a temporary workaround for development or testing environments.


answered