AIKIDO-2026-133619

TL;DR

The connector validates TLS certificate revocation using OCSP responses that are not bound to the certificate being checked, so a response issued for a different certificate can be accepted for the one under validation. Definitive verification failures such as a CertID mismatch or an invalid response signature are treated as soft, retryable errors under the default fail-open configuration and do not stop the connection. An on-path adversary holding a revoked certificate and its private key can therefore complete an encrypted session to a Snowflake endpoint despite the revocation. The fix binds each OCSP response to the requested CertID and makes definitive failures close the connection even in fail-open mode.