Power BI Desktop ODBC connection to Azure Databricks fails with SSL certificate error

Question

Hello,

I am trying to connect from Power BI Desktop to Azure Databricks using the built-in Databricks connector (Simba ODBC driver). However, the connection fails with the following error:

ODBC: ERROR [HY000] [Microsoft][ThriftExtension] (14)  
Unexpected response from server during a HTTP connection:  
SSL_connect: certificate verify failed.

So far, I have checked:

Proxy settings → confirmed direct access (no proxy server configured).

Other services (e.g., Azure Storage, SharePoint Online) work fine from the same machine.

The issue seems to be specific to Databricks connections.

Has anyone experienced a similar issue? What would be the recommended way to resolve SSL verification failures with the Simba ODBC driver in Power BI Desktop?

Thanks in advance for your help!

Answer 1

Hello 羅　秋嫻, Thanks for reaching out, Microsoft QnA!

The community member correctly identified that corporate firewalls or proxies that perform SSL inspection can interfere with the connection. Their suggestion to manually add the corporate root certificate to the driver's cacerts.pem file works.

Thank you, Jerald Felix really appreciates the comprehensive response and solutions which cover the most common causes of SSL certificate verification failures.

However, a more robust and manageable long-term solution is to instruct the driver to use the native Windows Certificate Store. Corporate-managed devices typically have the required company root certificates automatically installed here by IT administrators.

Since it is not affected by driver updates, which might overwrite a manually modified cacerts.pem file.

It relies on the centrally managed and trusted certificate store of the operating system.

How you can implement it:

1. Navigate to the Simba Spark ODBC driver directory, as mentioned previously: C:\Program Files\Microsoft Power BI Desktop\bin\ODBC Drivers\Simba Spark ODBC Driver\
2. Open or create the microsoft.sparkodbc.ini file.
3. Add the following configuration. You can use this in place of, or in addition to, the CheckCertRevocation=0 setting.ini

      [Driver]
   

4. Save the file, completely restart Power BI Desktop, and try the connection again.

Alternatively, you can further Verify Network Path for Azure Databricks with Private Link

In highly secure environments, Azure Databricks workspaces are often deployed with Azure Private Link, which disables the public internet endpoint. When this is the case, you can only connect to Databricks from within the designated Azure Virtual Network (VNet) or a peered network.

If your Power BI Desktop machine is trying to connect to the public URL of a private-link-enabled workspace, the connection will fail. This can sometimes manifest as an SSL or certificate verification error because you are not reaching the expected endpoint.

How to Troubleshoot

Check with your Azure Administrator: The quickest way is to ask if the target Azure Databricks workspace is configured with Private Link and has public network access disabled.

Perform a DNS Lookup: You can check this yourself from your machine.

• Open a Command Prompt or PowerShell terminal.
  • Run the nslookup command against your Databricks workspace URL (e.g., adb-xxxxxxxxxxxxxxxx.xx.azuredatabricks.net).

    nslookup your-workspace-url.azuredatabricks.net
  

Analyze the output

• If the command returns a private IP address (e.g., in the 10.x.x.x or 192.168.x.x range), it confirms the workspace is using a private endpoint. Your machine must be on the same network to connect successfully.
  • If it returns a public IP address, then Private Link is likely not the cause of your issue.

If Private Link is the cause, you must connect from a machine that has a network path to the Databricks VNet, such as an Azure Virtual Machine or a machine connected via a corporate VPN or ExpressRoute.

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush

Answer 2

Hello 羅　秋嫻,

Thank you for reaching out. The "SSL_connect: certificate verify failed" error you are encountering when connecting Power BI to Azure Databricks is a common issue. It typically indicates that the ODBC driver on your machine cannot verify the SSL certificate presented by the Databricks server, often due to network security configurations like firewalls or proxies.

Here are the most effective solutions to resolve this, starting with the most common fix.

Solution 1: Disable Certificate Revocation Check

The most frequent cause of this error is that a firewall or network policy is blocking the ODBC driver from contacting the Certificate Revocation List (CRL) distribution point to validate the certificate. The simplest way to fix this is to configure the driver to skip this check.

1. Navigate to the Simba Spark ODBC driver directory within your Power BI installation folder. The path is typically: C:\Program Files\Microsoft Power BI Desktop\bin\ODBC Drivers\Simba Spark ODBC Driver\

Inside this directory, create a new text file.

Name the file microsoft.sparkodbc.ini (ensure the extension is .ini and not .txt).

Open the file and add the following content :

text
[Driver]

Save the file, close Power BI Desktop completely, and then reopen it and try the connection again. This resolves the issue in most cases.

Solution 2: Address Corporate Proxy or Firewall Interference

If you are on a corporate network that uses a proxy server or firewall for SSL inspection (e.g., Zscaler, Palo Alto), the security appliance may be replacing the Databricks certificate with its own. This breaks the trust chain for the ODBC driver.

Action: You will need to add the corporate root/intermediate certificate to the ODBC driver's trusted list. You should contact your IT or network security team to obtain the correct certificate file (.pem or .crt).

Steps: Once you have the certificate, you can append its contents to the driver's certificate authority file, which is often located at C:\Program Files\Simba Spark ODBC Driver\lib\cacerts.pem.

Solution 3: Update the Simba Spark ODBC Driver

An outdated driver can cause various connectivity issues, including SSL failures. Ensure you are using the latest version.

Action: Download and install the latest Simba Spark ODBC driver directly from the official Databricks website.

Further Troubleshooting

If the problem persists after trying the solutions above, you can enable more detailed logging to diagnose the root cause :

Edit the microsoft.sparkodbc.ini file you created in Solution 1.

Add the following lines to enable detailed error messages :

text
[Driver]

Reproduce the error. The more detailed logs may provide additional clues. You can also check the Windows CAPI2 event logs in the Event Viewer for more insights into certificate chain validation issues.

I recommend starting with Solution 1, as it is the most common and straightforward fix.

Best regards,

Jerald Felix