Wider variety of Certificate Authorities and shorter certificate lifetimes¶

As part of Snowflake’s continued commitment to providing best-in-class transport-layer-security (TLS) we are introducing Let’s Encrypt and Google Trust Services as additional Certificate Authority (CA) providers alongside our existing providers. You may see certificates issued by these CAs when connecting to endpoints owned by Snowflake. We are also investing in shortening our certificate lifetime to meet and exceed upcoming CA/Browser Forum standards.

This unbundled change will not affect the endpoints most drivers use to connect to Snowflake, specifically the SNOWFLAKE_DEPLOYMENT and SNOWFLAKE_DEPLOYMENT_REGIONLESS types returned by SYSTEM$ALLOWLIST and SYSTEM$ALLOWLIST_PRIVATELINK. When the list of possible CAs for these existing endpoints is expanded, separate communications will be sent.

This unbundled change may affect any of the other domains owned by Snowflake and returned by SYSTEM$ALLOWLIST and SYSTEM$ALLOWLIST_PRIVATELINK, such as SNOWSIGHT_DEPLOYMENT. You will likely see these new certificates if you access Snowflake services through a web browser, if you access SPCS endpoints programmatically, or if you use Snowpipe Streaming with High Performance Architecture.

A small number of Snowflake sites, including app.snowflake.com, were already using certificates issued by some of these CAs prior to 2026.