An SSL-inspecting proxy is intercepting the TLS handshake and failing to complete it. The JRE version only supports older TLS versions (TLS 1.0/1.1) that Snowflake no longer accepts. Cipher suite mismatch between the client JVM and Snowflake's required ciphers. JVM security policy restricting TLS extensions needed for Snowflake's handshake. Network appliance performing deep packet inspection disrupting the TLS ClientHello

Upgrade the JRE to JDK 11 or higher — it supports TLS 1.2 and 1.3 and modern cipher suites by default.. Explicitly enable TLS 1.2: add -Dhttps.protocols=TLSv1.2,TLSv1.3 to JVM arguments.. Check if SSL inspection is active: openssl s_client -connect .snowflakecomputing.com:443 and inspect the certificate issuer.. Work with the network team to add Snowflake endpoints to the SSL inspection bypass list.. Disable restricted cipher suites in the JVM security policy if they are blocking required ciphers.

High severityconnectionSnowflake →

Power BI Refresh Error:
JDBC 9

What does this error mean?

The TLS handshake between the JDBC driver and Snowflake failed before the connection was established. The server terminated the handshake, which is typically caused by SSL inspection, protocol version mismatch, or cipher suite incompatibility.

Common causes

1An SSL-inspecting proxy is intercepting the TLS handshake and failing to complete it
2The JRE version only supports older TLS versions (TLS 1.0/1.1) that Snowflake no longer accepts
3Cipher suite mismatch between the client JVM and Snowflake's required ciphers
4JVM security policy restricting TLS extensions needed for Snowflake's handshake
5Network appliance performing deep packet inspection disrupting the TLS ClientHello

How to fix it

1Upgrade the JRE to JDK 11 or higher — it supports TLS 1.2 and 1.3 and modern cipher suites by default.
2Explicitly enable TLS 1.2: add -Dhttps.protocols=TLSv1.2,TLSv1.3 to JVM arguments.
3Check if SSL inspection is active: openssl s_client -connect <account>.snowflakecomputing.com:443 and inspect the certificate issuer.
4Work with the network team to add Snowflake endpoints to the SSL inspection bypass list.
5Disable restricted cipher suites in the JVM security policy if they are blocking required ciphers.

Frequently asked questions

Does Snowflake require a minimum TLS version?

Yes — Snowflake requires TLS 1.2 or higher. TLS 1.0 and 1.1 connections are rejected. Ensure the JRE and JVM TLS configuration support TLS 1.2 or 1.3.

How do I check which TLS version my JDBC connection is using?

Enable SSL debugging: add -Djavax.net.debug=ssl:handshake to JVM arguments and look for the TLS version in the ClientHello output.

Official documentation: https://docs.snowflake.com/en/user-guide/client-connectivity-troubleshooting/error-messages