Qlik Talend "PKIX path building failed” when connecting to Snowflake

[Greg_Taffer]

The PKIX path building failed error in Qlik Talend when connecting to Snowflake indicates that Java cannot verify the SSL certificate of the Snowflake server. This typically occurs because the necessary certificate is missing or untrusted in the Java TrustStore used by Qlik Talend.

Resolution

1. Download the Snowflake SSL Certificate
   
   
   1. Access your Snowflake account URL in a web browser (e.g., Chrome).
   2. Export the SSL certificate chain from the browser. This usually involves clicking on the padlock icon (A) in the address bar, then navigating to certificate details (B) and exporting (C) the certificates.
      
      
      
      
      
      
      
      
2. Import the Certificate into the Java TrustStore
   
   
   1. Identify the Java TrustStore: Determine which Java Runtime Environment (JRE) Qlik Talend is using. You can check this in the Qlik Talend Studio under Windows > Preferences > Java > Installed JREs. The cacerts file within the JRE's lib/security directory is the default TrustStore.  (Example: C:\Talend\Studio\zulu17.48.15-ca-jdk17.0.10-win_x64\lib\security\cacerts)
      
      
   2. Use the keytool utility: Open a command prompt and navigate to the bin directory of your JRE. Use the keytool command to import the downloaded Snowflake certificate into the cacerts file.
      
      
3. Use a Command Prompt to import the certificates
   
   Example commands:
   
   

   cd C:\Talend\Studio\zulu17.48.15-ca-jdk17.0.10-win_x64\lib\security

   keytool -import -trustcacerts -alias snowflakeCert -file  -keystore cacerts -storepass changeit

   
   Replace <path_to_downloaded_certificate> with the path to the certificate you downloaded (Example C:/User/Downloads/snowflake.cer).
   
   
4. Configure Qlik Talend for Custom TrustStore (if necessary)
   
   If you choose to use a custom TrustStore instead of the default cacerts, you will need to configure your Qlik Talend Job or Studio to use this custom TrustStore. 
   
   This typically involves setting Java system properties such as javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword in your Qlik Talend Job's advanced settings or in the Studio's JVM arguments.
   
   
   
   
5. Verify Network Configuration
   
   You can set the Qlik Talend Studio proxy settings either through the GUI by going to Windows > Preferences > General > Network Connections or by editing the .ini file in the installation directory for system-level or command-line settings. 
   
   The GUI method is for configuring connection settings within the Studio application, while the .ini method is useful for command-line execution or when the GUI option is unavailable.
   
   
   

Environment

• Qlik Talend Studio