If you use a certificate, you must either use SCHANNEL as the auth package or use FE security and specify exactly one auth ...