The JDBC connection URL uses an incorrect or legacy account URL format that does not match the certificate. An SSL-inspecting proxy is substituting its own certificate for a different hostname. Using a vanity domain or custom hostname that is not in the Snowflake certificate's SANs. The account was migrated to a new URL format but the JDBC connection string was not updated. A region-specific account URL mismatch (e.g., using the wrong region suffix)

How do I fix JDBC 11?

Verify the correct account URL: go to Admin > Accounts in Snowflake and copy the exact account identifier.. Use the standard URL format: jdbc:snowflake:// .snowflakecomputing.com/.. Run openssl s_client -connect :443 and check the SANs in the certificate to confirm the expected hostname.. If using SSL inspection, ensure the proxy is configured to pass-through Snowflake traffic (add to bypass list).. For accounts using vanity domains, configure the driver to accept the correct certificate for that domain.

High severityconnectionSnowflake →

Power BI Refresh Error:
JDBC 11

What does this error mean?

The JDBC driver rejected Snowflake's TLS certificate because the hostname in the connection URL does not match any Subject Alternative Name (SAN) in the certificate. This indicates either a wrong account URL or SSL inspection replacing the certificate.

Common causes

1The JDBC connection URL uses an incorrect or legacy account URL format that does not match the certificate
2An SSL-inspecting proxy is substituting its own certificate for a different hostname
3Using a vanity domain or custom hostname that is not in the Snowflake certificate's SANs
4The account was migrated to a new URL format but the JDBC connection string was not updated
5A region-specific account URL mismatch (e.g., using the wrong region suffix)

How to fix it

1Verify the correct account URL: go to Admin > Accounts in Snowflake and copy the exact account identifier.
2Use the standard URL format: jdbc:snowflake://<account>.snowflakecomputing.com/.
3Run openssl s_client -connect <url>:443 and check the SANs in the certificate to confirm the expected hostname.
4If using SSL inspection, ensure the proxy is configured to pass-through Snowflake traffic (add to bypass list).
5For accounts using vanity domains, configure the driver to accept the correct certificate for that domain.

Frequently asked questions

How do I check the SANs in Snowflake's certificate?

Run openssl s_client -connect <account>.snowflakecomputing.com:443 -showcerts 2>/dev/null | openssl x509 -text -noout | grep -A1 'Subject Alternative' to list all valid hostnames.

Can I add a custom hostname to Snowflake's certificate?

No — Snowflake manages its own certificates. If you need a custom hostname, use a CNAME to <account>.snowflakecomputing.com and ensure SNI is correctly passed through your load balancer.

Official documentation: https://docs.snowflake.com/en/user-guide/client-connectivity-troubleshooting/error-messages