diff --git a/src/main/java/net/snowflake/client/jdbc/RestRequest.java b/src/main/java/net/snowflake/client/jdbc/RestRequest.java
index 5be46c5de..c753c87de 100644
--- a/src/main/java/net/snowflake/client/jdbc/RestRequest.java
+++ b/src/main/java/net/snowflake/client/jdbc/RestRequest.java
@@ -283,7 +283,14 @@ public static CloseableHttpResponse execute(
         // if an SSL issue occurs like an SSLHandshakeException then fail
         // immediately and stop retrying the requests
 
-        throw new SnowflakeSQLLoggedException(null, ErrorCode.NETWORK_ERROR, ex, ex.getMessage());
+        String formattedMsg =
+            ex.getMessage()
+                + "\n"
+                + "Verify that the hostnames and portnumbers in SYSTEM$ALLOWLIST are added to your firewall's allowed list.\n"
+                + "To troubleshoot your connection further, you can refer to this article:\n"
+                + "https://docs.snowflake.com/en/user-guide/client-connectivity-troubleshooting/overview";
+
+        throw new SnowflakeSQLLoggedException(null, ErrorCode.NETWORK_ERROR, ex, formattedMsg);
 
       } catch (Exception ex) {
 
diff --git a/src/test/java/net/snowflake/client/jdbc/ConnectionLatestIT.java b/src/test/java/net/snowflake/client/jdbc/ConnectionLatestIT.java
index efed33896..0fb5bc910 100644
--- a/src/test/java/net/snowflake/client/jdbc/ConnectionLatestIT.java
+++ b/src/test/java/net/snowflake/client/jdbc/ConnectionLatestIT.java
@@ -12,6 +12,7 @@
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.instanceOf;
 import static org.hamcrest.core.AnyOf.anyOf;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
@@ -49,6 +50,7 @@
 import java.util.Map;
 import java.util.Properties;
 import java.util.concurrent.TimeUnit;
+import javax.net.ssl.SSLHandshakeException;
 import net.snowflake.client.ConditionalIgnoreRule;
 import net.snowflake.client.RunningNotOnAWS;
 import net.snowflake.client.RunningOnGithubAction;
@@ -1618,4 +1620,24 @@ public void shouldGetOverridenConnectionAndSocketTimeouts() throws Exception {
       assertEquals(Duration.ofMillis(200), HttpUtil.getSocketTimeout());
     }
   }
+
+  /** Added in > 3.19.0 */
+  @Test
+  public void shouldFailOnSslExceptionWithLinkToTroubleShootingGuide() {
+    Properties properties = new Properties();
+    properties.put("user", "fakeuser");
+    properties.put("password", "testpassword");
+    properties.put("ocspFailOpen", Boolean.FALSE.toString());
+
+    try {
+      DriverManager.getConnection("jdbc:snowflake://expired.badssl.com/", properties);
+      fail("should fail");
+    } catch (SQLException e) {
+      assertThat(e.getCause(), instanceOf(SSLHandshakeException.class));
+      assertTrue(
+          e.getMessage()
+              .contains(
+                  "https://docs.snowflake.com/en/user-guide/client-connectivity-troubleshooting/overview"));
+    }
+  }
 }