topic Re: using remote_query with SQL Serverless Warehouse in Data Engineering

using remote_query with SQL Serverless Warehouse

dsay96 — Thu, 17 Sep 2026 11:28:20 GMT

Hello,

Im trying to set up remote_query() as an option for our developers to use when querying our DB2 server. Unfortunately the connection keeps timing out. The workspace is in a VPC in AWS and the interactive clusters can successfully use the JDBC connection from Unity Catalog to access tables in the DB2. For serverless we set up and established an NCC private endpoint rule, an AWS PrivateLink endpoint, AWS NLB, and a target group. All elements of the networking part are healthy and accepted. What I think is the issue would be that there is no way to pass the TSL certs in the handshake between dbx warehouse and db2 server. Has anyone gotten this flow working before?

Re: using remote_query with SQL Serverless Warehouse

Satyasai — Thu, 17 Sep 2026 12:52:14 GMT

Hi @dsay96

Try these steps

Troubleshooting & Resolution Steps
1. Pass DB2 SSL Parameters directly in the Unity Catalog JDBC Connection
Within the Unity Catalog Connection definition you're using within remote_query(), pass the JDBC URL or options for explicit SSL properties:

Option A: Explicit CA Certificate (Recommended)
Pass the CA certificate file path (if uploaded to a UC Volume) or embed the truststore parameters in the Connection Options:

Plaintext
sslConnection=true;sslTrustStoreLocation=/Volumes/main/default/jars/db2_truststore.jks;sslTrustStorePassword=your_password;
(Make sure the SQL Warehouse's service principal / users have READ VOLUME access to the UC Volume containing the .jks or .pem file).

Option B: Test with Unverified SSL (Isolation Test)
To see if the TLS is actually causing the timeout, temporarily relax certificate validation in your UC Connection string properties:

Plaintext
sslConnection=true;sslTrustStoreLocation=null;
(Or setting the driver property: sslConnection=true with trustServerCertificate properties depending on your specific DB2 JDBC driver version.

2. Validate PrivateLink Port & Target Group routing
Since Serverless will be using your Network Connectivity Config (NCC) Private Endpoint Rule:

DB2 typically uses port 50000 (non-SSL) and 50001 (SSL). Ensure your AWS NLB listener and Target Group are explicitly listening on the SSL port (e.g., 50001) and forwarding to the correct DB2 port.

Check that the Security Group attached to the AWS NLB explicitly allows ingress traffic from the Serverless Subnet CIDR assigned to your Databricks NCC endpoint.

Re: using remote_query with SQL Serverless Warehouse

dsay96 — Thu, 17 Sep 2026 13:12:11 GMT

For generic Unity Catalog JDBC connections on Serverless SQL, can the isolated JDBC environment use a custom JKS truststore supplied through a Unity Catalog Volume? The documentation currently states that SSL certificates are not supported. We use JTOpen/JT400 and need a private CA certificate to connect to IBM i over TLS port 9471.

Re: using remote_query with SQL Serverless Warehouse

dsay96 — Thu, 17 Sep 2026 13:14:16 GMT

@Satyasai

Re: using remote_query with SQL Serverless Warehouse

balajij8 — Thu, 17 Sep 2026 14:53:33 GMT

@dsay96 You can use interactive compute or try to replace the private CA cert with a public CA cert on the IBM server. If the server presents a certificate from a recognized public CA (DigiCert etc), the serverless runtime's default ca certs truststore may validate it automatically and hence no custom truststore may be needed.