An SSL-inspecting proxy (firewall/corporate appliance) is replacing the Snowflake certificate with a self-signed one. The system's CA certificate bundle is outdated and does not include Snowflake's certificate authority. OCSP validation failed — the certificate revocation check returned an invalid or unavailable response. Account URL mismatch: connecting to a locator URL that does not match the certificate's Subject Alternative Names. Clock skew on the client machine causes certificate validity period checks to fail

If behind an SSL-inspecting proxy, add the proxy's root CA to the system trust store, or set insecure_mode=True as a temporary workaround (not for production).. Update the CA certificate bundle: pip install --upgrade certifi.. Check OCSP: if the OCSP responder is unreachable from the network, Snowflake's connector will use fail-open by default; investigate the OCSP network path.. Verify the account URL is correct — use the format .snowflakecomputing.com.. Sync the system clock: ntpdate pool.ntp.org or equivalent.

High severityconnectionSnowflake →

Power BI Refresh Error:
250011

What does this error mean?

The Python connector rejected the TLS/SSL certificate presented by the Snowflake server or an intermediate proxy. Certificate validation failed, preventing a secure connection from being established.

Common causes

1An SSL-inspecting proxy (firewall/corporate appliance) is replacing the Snowflake certificate with a self-signed one
2The system's CA certificate bundle is outdated and does not include Snowflake's certificate authority
3OCSP validation failed — the certificate revocation check returned an invalid or unavailable response
4Account URL mismatch: connecting to a locator URL that does not match the certificate's Subject Alternative Names
5Clock skew on the client machine causes certificate validity period checks to fail

How to fix it

1If behind an SSL-inspecting proxy, add the proxy's root CA to the system trust store, or set insecure_mode=True as a temporary workaround (not for production).
2Update the CA certificate bundle: pip install --upgrade certifi.
3Check OCSP: if the OCSP responder is unreachable from the network, Snowflake's connector will use fail-open by default; investigate the OCSP network path.
4Verify the account URL is correct — use the format <account>.snowflakecomputing.com.
5Sync the system clock: ntpdate pool.ntp.org or equivalent.

Frequently asked questions

Is insecure_mode=True safe?

No — it disables all certificate validation, making the connection vulnerable to man-in-the-middle attacks. Use it only for debugging and fix the underlying certificate issue promptly.

How do I tell if SSL inspection is the cause?

Run openssl s_client -connect <account>.snowflakecomputing.com:443 and inspect the certificate chain. If the issuer is your corporate proxy CA rather than Snowflake's CA, SSL inspection is active.

Official documentation: https://github.com/snowflakedb/snowflake-connector-python/blob/main/src/snowflake/connector/errorcode.py