Databricks TLS validation requires SNI with the correct hostname for certificate verification - Check if you are connecting to the metastore via IP instead of hostname. Always use the documented metastore hostname.

Ensure the Databricks Private Link VPC endpoints are configured (*.cloud.databricks.com & meta store) with "Enable Private DNS" checked so hostnames resolve to private IPs & not public. Verify the endpoint status is In Service in AWS VPC Console. Exclude *.cloud.databricks.com from interception if using a proxy/TLS inspection appliance