This also impacting snowflake-connector-python as well since snowflake would attempt to verify with OCSP and failed due to timing issue. It doesn't seem like the ignore list isn't honored. I checked the method _should_use_real_time and it seems like it's not matching correctly for some reason.

@lucemia I found a potential bug of freezegun that causes the issue for Google API:

For the google library, it uses google.auth._helpers.utcnow.utcnow() to request for a JWT token expiration, which in turn calls datetime.datetime.utcnow(). Freezegun override the datetime.datetime.utcnow with FakeDatetime.utcnow() method and this stub method unfortunately doesn't check against the ignore list.

The temporary fix is to monkey patch freezegun as follow:

def monkey_patch_freezegun_for_google_api():
    import freezegun

    def utcnow():
        if freezegun.api._should_use_real_time():
            result = freezegun.api.real_datetime.utcnow()
        else:
            result = freezegun.api.FakeDatetime._time_to_freeze()
        return freezegun.api.datetime_to_fakedatetime(result)

    freezegun.configure(
        extend_ignore_list=[
            "google",
        ]
    )

    setattr(freezegun.api.FakeDatetime, "utcnow", utcnow)


monkey_patch_freezegun_for_google_api()

Also, for snowflake connector, freezegun breaks the OCSP validation, and so far the solution is to use the insecure_mode. I had to apply this universally using the snowflake.connector.connection.DEFAULT_CONFIGURATION

    from snowflake.connector.connection import DEFAULT_CONFIGURATION
    DEFAULT_CONFIGURATION["insecure_mode"] = (True, bool)

Thanks for the patch @ale-hm - it helped.

Had exception:
google.auth.exceptions.RefreshError: ('invalid_grant: Invalid JWT: Token must be a short-lived token (60 minutes) and in a reasonable timeframe. Check your iat and exp values in the JWT claim.', {'error': 'invalid_grant', 'error_description': 'Invalid JWT: Token must be a short-lived token (60 minutes) and in a reasonable timeframe. Check your iat and exp values in the JWT claim.'})