An SSL-inspecting proxy is substituting its own certificate, which may be on a revocation list. A Snowflake certificate was legitimately revoked due to a key compromise (Snowflake would notify customers). The OCSP response cache contains a stale revoked entry for a certificate that has since been renewed. Corporate PKI CA certificate used for SSL inspection was revoked by the CA. Account is being routed to a deprecated or decommissioned Snowflake endpoint

Check if an SSL-inspecting proxy is active: openssl s_client -connect .snowflakecomputing.com:443 and inspect the certificate issuer.. Clear the OCSP response cache — the cache directory is typically in $HOME/.cache/snowflake/ or %APPDATA%/Snowflake/.. Verify Snowflake's status page (status.snowflake.com) for any security announcements about certificate revocation.. If using an SSL-inspecting proxy, add the proxy's root CA to the system trust store.. Contact Snowflake Support if the revoked certificate is Snowflake's own — this would be a critical incident.

High severityconnectionSnowflake →

Power BI Refresh Error:
254007

What does this error mean?

The OCSP check confirmed that the TLS certificate presented by the Snowflake server or an intermediate CA has been revoked. This is a critical security signal — the connection is refused to protect against potential certificate compromise.

Common causes

1An SSL-inspecting proxy is substituting its own certificate, which may be on a revocation list
2A Snowflake certificate was legitimately revoked due to a key compromise (Snowflake would notify customers)
3The OCSP response cache contains a stale revoked entry for a certificate that has since been renewed
4Corporate PKI CA certificate used for SSL inspection was revoked by the CA
5Account is being routed to a deprecated or decommissioned Snowflake endpoint

How to fix it

1Check if an SSL-inspecting proxy is active: openssl s_client -connect <account>.snowflakecomputing.com:443 and inspect the certificate issuer.
2Clear the OCSP response cache — the cache directory is typically in $HOME/.cache/snowflake/ or %APPDATA%/Snowflake/.
3Verify Snowflake's status page (status.snowflake.com) for any security announcements about certificate revocation.
4If using an SSL-inspecting proxy, add the proxy's root CA to the system trust store.
5Contact Snowflake Support if the revoked certificate is Snowflake's own — this would be a critical incident.

Frequently asked questions

How do I clear the OCSP cache?

Delete files in ~/.cache/snowflake/ocsp_response_cache.json (Linux/Mac) or %APPDATA%\Snowflake\ocsp_response_cache.json (Windows), then restart the connector.

Is a revoked certificate error always a security issue?

Not always — the most common cause is an SSL inspection proxy using a certificate that appears on a revocation list. Check the certificate issuer before escalating to a security incident.

Official documentation: https://github.com/snowflakedb/snowflake-connector-python/blob/main/src/snowflake/connector/errorcode.py