​

Connect Looker On‑Prem to Firebolt with mTLS (PostgreSQL Wire)

​

Prerequisites

1. Looker On-Prem – With admin access to configure database connections.
2. Firebolt account – You need an active Firebolt account. If you do not have one, you can sign up for one.
3. Firebolt database and table – You must have access to a Firebolt database that contains a table with data ready for visualization. If you don’t have access, you can create a database and then load data into it.
4. Firebolt service account – You must have access to an active Firebolt service account, which facilitates programmatic access to Firebolt, its ID and secret.
5. Firebolt user – You must have a user that is associated with your service account. The user should have USAGE permission to query your database, and OPERATE permission to start and stop an engine if it is not already started.

​

Step 1: Prepare SSL Certificate Files (mTLS)

​

If you need to generate certificates

#!/bin/bash
set -e

CLIENT_CN="firebolt.looker"
DAYS_VALID=730
CA_DIR="./fb-ca"

# Create CA (optional if using company CA)
mkdir -p "$CA_DIR"
openssl genrsa -out "$CA_DIR/ca.key" 4096
openssl req -x509 -new -nodes -key "$CA_DIR/ca.key" -sha256 -days "$DAYS_VALID" \
  -out "$CA_DIR/ca.crt" -subj "/CN=$CLIENT_CN"

# Create RSA key and convert to PKCS#8 DER
openssl genrsa -out fb-rsa.key 2048
openssl pkcs8 -topk8 -inform PEM -outform DER -nocrypt -in fb-rsa.key -out fb.pk8

# Public key for Firebolt service account
openssl pkey -in fb.pk8 -inform DER -pubout -out fb-public.pem

# CSR and client certificate signed by the CA
openssl req -new -key fb-rsa.key -out fb.csr -subj "/CN=$CLIENT_CN"
openssl x509 -req -in fb.csr -CA "$CA_DIR/ca.crt" -CAkey "$CA_DIR/ca.key" -CAcreateserial \
  -out fb.crt -days "$DAYS_VALID" -sha256

# Cleanup
rm -rf fb.csr fb-rsa.key $CA_DIR

• fb.pk8 – private key (PKCS#8 DER)
• fb.crt – client certificate
• fb-public.pem – public key to attach to your Firebolt service account

​

If you already have the certificates

• client-cert.pem — client certificate
• client-key.pk8 — client private key (PKCS#8 DER)

openssl pkcs8 -topk8 -inform PEM -outform DER \
  -in client-key.pem -out client-key.pk8 -nocrypt

openssl pkey -inform DER -in client-key.pk8 -pubout -out client-public.pem

​

Step 2: Place the certificate files on the Looker host

Upload only the public key to Firebolt. Do not share the private key.

# Paths
/path/to/client-cert.pem
/path/to/client-key.pk8

# Permissions
chmod 600 /path/to/client-key.pk8
chmod 644 /path/to/client-cert.pem

# Optional ownership if Looker runs as user "looker"
chown looker:looker /path/to/client-cert.pem /path/to/client-key.pk8

​

Step 3: Attach the Public Key to the Firebolt Service Account

ALTER SERVICE ACCOUNT "your_account" SET PUBLIC_KEY = '-----BEGIN PUBLIC KEY-----
<contents of client-public.pem or fb-public.pem>
-----END PUBLIC KEY-----';

Ensure the service account is attached to a user in the Firebolt account and has privileges to access the target database/engine.

​

Step 4: Create the Looker On‑Prem Connection (mTLS)

​

Determine the correct Firebolt host (region)

SELECT region FROM information_schema.accounts WHERE account_name = '<your_account>';

​

Database field format

<account_name>@<database_name>@<engine_name>

​

Final Steps & Troubleshooting

1. Click Test; if successful, click Connect.
2. If the test fails, verify:

• Absolute paths to sslcert and sslkey exist and are readable by the Looker process.
• The private key is PKCS#8 DER (*.pk8).
• The service account’s public key is attached in Firebolt.
• The host region, account, database, and engine are correct.
• The service account has the necessary permissions and the ID/secret are correct.

​

Performance and Limits

​

Compatibility Notes

• Unsupported functions: diff_days(), diff_hours(), contains(), exp().
• Partially supported functions: extract_minutes(), trunc_months() (only work with TIMESTAMP/TIMESTAMPTZ, not DATE).
• Unsupported metrics: Median, list of unique values.
• Unsupported dimension types: Any date_... or duration_... types. Use custom SQL dimensions in .view.lkml instead like:

dimension: diff_days_now {
  sql: CAST(DATE_DIFF('day', DATE_TRUNC('day', table."column"), CURRENT_TIMESTAMP) AS BIGINT);;
}