The OCSP response cache contains old entries and the OCSP responder is unreachable for renewal. System clock is incorrect — an expired OCSP response appears valid if the clock is behind. Firewall blocking HTTP access to the OCSP responder, preventing cache refresh. The OCSP responder issued a response with an unusually short validity window. The connector has been running in a network-isolated environment without OCSP access for too long

Clear the OCSP cache: delete ~/.cache/snowflake/ocsp_response_cache.json.. Ensure the OCSP responder is reachable: curl -I http://ocsp.snowflakecomputing.com.. Sync the system clock: sudo ntpdate pool.ntp.org or check NTP configuration.. Allow outbound HTTP (port 80) to the OCSP responder in firewall rules.. As a temporary workaround, set OCSP fail-open mode via the environment variable SNOWFLAKE_OCSP_RESPONSE_CACHE_SERVER_ENABLED=true.

Medium severityconnectionSnowflake →

Power BI Refresh Error:
254013

What does this error mean?

The cached OCSP response used to validate Snowflake's TLS certificate has expired and the connector could not fetch a fresh response. The connector blocks the connection until a valid OCSP response is available.

Common causes

1The OCSP response cache contains old entries and the OCSP responder is unreachable for renewal
2System clock is incorrect — an expired OCSP response appears valid if the clock is behind
3Firewall blocking HTTP access to the OCSP responder, preventing cache refresh
4The OCSP responder issued a response with an unusually short validity window
5The connector has been running in a network-isolated environment without OCSP access for too long

How to fix it

1Clear the OCSP cache: delete ~/.cache/snowflake/ocsp_response_cache.json.
2Ensure the OCSP responder is reachable: curl -I http://ocsp.snowflakecomputing.com.
3Sync the system clock: sudo ntpdate pool.ntp.org or check NTP configuration.
4Allow outbound HTTP (port 80) to the OCSP responder in firewall rules.
5As a temporary workaround, set OCSP fail-open mode via the environment variable SNOWFLAKE_OCSP_RESPONSE_CACHE_SERVER_ENABLED=true.

Frequently asked questions

How often does the OCSP cache need to be refreshed?

OCSP responses are typically valid for 24–48 hours. The connector refreshes them automatically if the OCSP responder is reachable. Issues arise when the network blocks this refresh.

Does a wrong system clock cause OCSP errors?

Yes — if the clock is ahead of the OCSP response's nextUpdate time, it appears expired. Sync the clock with NTP before clearing the cache.

Official documentation: https://github.com/snowflakedb/snowflake-connector-python/blob/main/src/snowflake/connector/errorcode.py