With Snowflake enforcing the deprecation of legacy password-based authentication, all data integration pipelines must transition to Key-Pair authentication.
Prerequisites & Architecture
OGG User: Standard OS account (typically oracle) with access to the GoldenGate installation directory.
Snowflake User: Dedicated service user (e.g., GGDEV) with appropriate roles, warehouse access and permissions (SECURITYADMIN or ACCOUNTADMIN access required to assign keys).
Dependencies: Snowflake JDBC driver and Bouncy Castle FIPS cryptographic libraries (required for decrypting PKCS#8 encrypted private keys).
1. Generate an encrypted RSA key pair
Run the following commands on the GoldenGate server as the oracle user to generate a 2048-bit encrypted private key and its public key:
# Private key - prompted for passphrase twice
[oracle@sdevcdc01 ogg_keys]$ openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_GGDEV.p8
Generating RSA private key, 2048 bit long modulus (2 primes)
......................................................................................+++++
.......................................................................................................+++++
e is 65537 (0x010001)
Enter Encryption Password:
Verifying - Enter Encryption Password:
You have mail in /var/spool/mail/oracle
[oracle@sdevcdc01 ogg_keys]$
# Generate public key from encrypted private key - promted for the passphrase once
[oracle@sdevcdc01 ogg_keys]$ openssl rsa -in rsa_GGDEV.p8 -pubout -out rsa_GGDEV.pub
Enter pass phrase for rsa_GGDEV.p8:
writing RSA key
[oracle@sdevcdc01 ogg_keys]$
chmod 600 /u01/app/oracle/ogg_keys/rsa_GGDEV.p8
Note : Ensure you note your encryption passphrase. Supported special characters tested with OGG (These are tested) ! @ - _ . ? ; * ,
2. Extract the public key in a single line
Snowflake requires the raw base64 string without headers, footers, or newlines:
grep -v "PUBLIC KEY" /u01/app/oracle/ogg_keys/rsa_GGDEV.pub | tr -d '\n'
3. Assign the public key for the user of Snowflake
Log in to the Snowflake Web UI or SnowSQL as an administrator and assign the key to GoldenGate user:
ALTER USER GGDEV SET RSA_PUBLIC_KEY='MIIBkjrekqhdtwe46874-3A.......';
-- Verify the key fingerprint matches
DESCRIBE USER GGUSER;
(Do not include the line containing -----BEGIN PUBLIC KEY----- or -----END PUBLIC KEY-----)
Validate public key was correctly set, run the command describe user GGDEV and note the value of RSA_PUBLIC_KEY. It would match the value which was set earlier for the user.
4. Download FIPS & Bouncy Castle (BC) 2.x dependencies
The script snowflake-fips.sh can be used for the purpose. It can be found under the directory (OGGDAA home) . It might download older version of BC jar which will not work. Raised SR with Oracle support to get this sorted. The replicat requires 2.x version. Following jar files are needed to make it operational. Without the bc*.jar files, it would not be possible to connect to Snowflake. The decrypt mechanism just fails to decrypt the key without the correct version of bouncycastle.
bcutil-fips-2.0.7.jar
bc-fips-2.0.1.jar
bcpkix-fips-2.0.8.jar
snowflake-jdbc-fips-3.28.0.jar
GoldenGate 23ai running the Snowflake FIPS driver requires the Bouncy Castle 2.x FIPS spec (bc-fips-2.0.x), whereas earlier automated scripts pulled 1.x dependencies, causing silent decryption errors (NoSuchAlgorithmException or PKCS8KeySpec parsing errors).
This part is not clearly mentioned in the documentation present on the website of Oracle.
[oracle@sdevcdc01 DependencyDownloader]$ ./snowflake-fips-custom.sh 3.28.0
openjdk version "21.0.11" 2026-04-21 LTS
Java is installed.
Apache Maven 3.9.11 (3e54c93a704957b63ee3494413a2b544fd3d825b)
Maven is accessible.
Root Configuration Script
INFO: This is the Maven binary [../../ggjava/maven-3.9.11/bin/mvn].
INFO: This is the location of the settings.xml file [./docs/settings_np.xml].
INFO: This is the location of the toolchains.xml file [./docs/toolchains.xml].
INFO: The dependencies will be written to the following directory[/u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0].
INFO: The Maven coordinates are the following:
INFO: Group ID [net.snowflake].s
INFO: Artifact ID [snowflake-jdbc-fips].
INFO: Version [3.28.0]
INFO: bc-fips version [2.0.1]
INFO: bcpkix-fips version [2.0.8]
INFO: bcutil-fips version [2.0.7]
[INFO] Scanning for projects...
[INFO]
[INFO] ---------------< oracle.goldengate:dependencyDownloader >---------------
[INFO] Building dependencyDownloader 1.0
[INFO] from snowflake-fips-custom.ZsJCgD.xml
[INFO] --------------------------------[ pom ]---------------------------------
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/2.0.1/bc-fips-2.0.1.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/2.0.1/bc-fips-2.0.1.pom (1.3 kB at 3.2 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcpkix-fips/2.0.8/bcpkix-fips-2.0.8.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcpkix-fips/2.0.8/bcpkix-fips-2.0.8.pom (1.8 kB at 37 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/maven-metadata.xml
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/maven-metadata.xml (807 B at 22 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/2.0.0/bc-fips-2.0.0.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/2.0.0/bc-fips-2.0.0.pom (1.3 kB at 24 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/2.0.2/bc-fips-2.0.2.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/2.0.2/bc-fips-2.0.2.pom (1.3 kB at 23 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/maven-metadata.xml
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/maven-metadata.xml (582 B at 15 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.2/bcutil-fips-2.0.2.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.2/bcutil-fips-2.0.2.pom (1.6 kB at 27 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.3/bcutil-fips-2.0.3.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.3/bcutil-fips-2.0.3.pom (1.6 kB at 34 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.5/bcutil-fips-2.0.5.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.5/bcutil-fips-2.0.5.pom (1.6 kB at 28 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.6/bcutil-fips-2.0.6.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.6/bcutil-fips-2.0.6.pom (1.6 kB at 27 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.7/bcutil-fips-2.0.7.pom
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.7/bcutil-fips-2.0.7.pom (1.6 kB at 30 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/2.0.1/bc-fips-2.0.1.jar
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bc-fips/2.0.1/bc-fips-2.0.1.jar (4.1 MB at 21 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcpkix-fips/2.0.8/bcpkix-fips-2.0.8.jar
Downloading from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.7/bcutil-fips-2.0.7.jar
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcutil-fips/2.0.7/bcutil-fips-2.0.7.jar (718 kB at 9.4 MB/s)
Downloaded from central: https://repo.maven.apache.org/maven2/org/bouncycastle/bcpkix-fips/2.0.8/bcpkix-fips-2.0.8.jar (1.0 MB at 10 MB/s)
[INFO]
[INFO] --- clean:3.2.0:clean (default-clean) @ dependencyDownloader ---
[INFO] Deleting /u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0
[INFO]
[INFO] --- dependency:2.9:copy-dependencies (copy-dependencies) @ dependencyDownloader ---
[INFO] Copying bcutil-fips-2.0.7.jar to /u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0/bcutil-fips-2.0.7.jar
[INFO] Copying bc-fips-2.0.1.jar to /u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0/bc-fips-2.0.1.jar
[INFO] Copying bcpkix-fips-2.0.8.jar to /u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0/bcpkix-fips-2.0.8.jar
[INFO] Copying snowflake-jdbc-fips-3.28.0.jar to /u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0/snowflake-jdbc-fips-3.28.0.jar
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 2.607 s
[INFO] Finished at: 2026-09-04T11:33:27+02:00
[INFO] ------------------------------------------------------------------------
[oracle@sdevcdc01 DependencyDownloader]$
5. Store the private key file information and the password of the snowflake user to the credential store(Wallet) of Golden Gate. Default domain is OracleGoldenGate
# Add private key path alias
alter credentialstore add user GGDEV ALIAS ggDEVWRK domain OracleGoldenGate password /u01/app/oracle/ogg_keys/rsa_GGDEV.p8
# Add private key passphrase alias
alter credentialstore add user GGDEV ALIAS ggDEVPASS domain OracleGoldenGate password "<YOUR_KEY_PASSPHRASE>"
6. Configure the properties file of the Replicat file
Remove legacy password authentication properties (gg.eventhandler.snowflake.UserName / gg.eventhandler.snowflake.Password)
Accomodate username and private key file and it's passphrase in the gg.eventhandler.snowflake.connectionURL
Also adapt the classpath to include the BC jar files.
Sample .properties file of the replicat
gg.target=snowflake
# Snowflake Connection URL using OGG Wallet aliases
gg.eventhandler.snowflake.connectionURL=jdbc:snowflake://<account_identifier>.snowflakecomputing.com/?warehouse=<WH>&db=<db>&user=GGDEV&role=DEV_ROLE&private_key_file=ORACLEWALLETPASSWORD[ggDEVWRK OracleGoldenGate]&private_key_pwd=ORACLEWALLETPASSWORD[ggDEVPASS OracleGoldenGate]&CLIENT_SESSION_KEEP_ALIVE=true&SESSION_IDLE_TIMEOUT_MINS=1440&CLIENT_SESSION_KEEP_ALIVE_HEARTBEAT_FREQUENCY=900&disablePlatformDetection=true&disableOCSPChecks=true
# Classpath pointing to Snowflake JDBC & BC-FIPS 2.x dependencies
gg.classpath=/u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0/snowflake-jdbc-fips-3.28.0.jar:/u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0/bcutil-fips-2.0.7.jar:/u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0/bc-fips-2.0.1.jar:/u01/app/ogg/ogg23ai_daa_ma/opt/DependencyDownloader/dependencies/snowflake-jdbc-3.28.0/bcpkix-fips-2.0.8.jar
jvm.bootoptions=-Xmx8g -Xms8g
gg.eventhandler.snowflake.maxConnections=200
gg.maxInlineLobSize=128000
7. Start the replicat
Start the process from the Admin Client or GUI:
start replicat RDEVWRK
view report RDEVWRK
Verify that the process status transitions to RUNNING without cryptographic or connection errors.
