Error "PKIX path building failed" When Connecting to Google BigQuery (JDBC)

Issue

When connecting to Google BigQuery using the Google BigQuery JDBC connector, the following error may occur:

Error Code: B19090E0
[Simba][BigQueryJDBCDriver](100004) HttpTransport IO error : javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.
Unable to connect to the Google BigQuery (JDBC) server "". Check that the server is running and that you have access privileges to the requested database.

Environment

Tableau Desktop
Google BigQuery JDBC

Resolution

Use the Certificate Viewer in Google Chrome to check for SSL inspection when accessing https://www.googleapis.com/:

In the Google Chrome browser, go to https://www.googleapis.com/
Click the padlock icon in the web address bar > Connection is secure > Certification is valid.
Click the Details tab.
Under Certificate Hierarchy, the topmost certificate should be GTS Root R1 if there is no SSL inspection. (The serial number of the certificate is 02:03:E5:93:6F:31:B0:13:49:88:6B:A2:17).
If the topmost certificate is not GTS Root R1, click 'Export' to export the certificate used by the proxy for SSL inspection. Save the certificate and note the location.

The BigQuery JDBC driver requires the certificate to be placed in a Java TrustStore (JKS file), which you can create using the Java keytool utility. See this Oracle Java document for instructions on how to use keytool. Alternatively, use KeyStore Explorer to create the KeyStore file (.jks) and import the server certificate.

After creating the .jks file, use a googlebigquery.properties file to customize the BigQuery JDBC connection:

Edit the attached sample googlebigquery.properties file in a text editor, such as Notepad.
Save the file to to Documents\My Tableau Repository\Datasources
Restart Tableau Desktop to apply the customization.

Note:

Any '\' characters in the .properties file, such as in file paths, must be escaped. Instead of C:\Users\username, you would use C:\\Users\\username.
The SSLTrustStore configuration option is used to specify the full path of the Java TrustStore containing the server certificate.
The SSLTrustStorePwd option is required when the SSLTrustStore option is used. If no password was configured when creating the trust store, use the following line in the properties file:

SSLTrustStorePwd=

Cause

When SSL inspection is configured in the network environment, the BigQuery JDBC driver may need to be configured to use the certificate when connecting to BigQuery.

Additional Information

Magnitude Simba Google BigQuery JDBC Data Connector

Disclaimer: The above links take you outside of Tableau.com. Although we make every effort to ensure links to external websites are accurate, up to date, and relevant, Tableau cannot take responsibility for the accuracy or freshness of pages maintained by external providers. Contact the external site for answers to questions regarding its content.