apache/cassandra · error · AuthenticationException

The validity period of the provided certificate

Error message

The validity period of the provided certificate (%s) exceeds the maximum allowed validity period of %s

What it means

AuthenticationException from MutualTlsCertificateValidityPeriodValidator.validate: the leaf certificate's total validity period (notAfter minus notBefore) exceeds the configured maximum allowed certificate age. This guards against long-lived certificates; the message reports the certificate's period and the configured maximum. Returns -1 (no-op) for empty/non-X509 input instead of throwing.

Solutions

Reissue the certificate with a shorter validity period within the configured maximum
Raise the maximum allowed certificate age configuration if the longer period is intentional
Track certificate renewal so short-lived certificates can be rotated before expiry

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/MutualTlsCertificateValidityPeriodValidator.java:75 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/09dfa5170239d034. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsCertificateValidityPeriodValidator.java:75

    public int validate(Certificate[] certificates) throws AuthenticationException
    {
        X509Certificate[] x509Certificates = MutualTlsUtil.castCertsToX509(certificates);
        if (x509Certificates == null || x509Certificates.length == 0)
        {
            return -1;
        }

        Date notAfter = x509Certificates[0].getNotAfter();

        int minutesToCertificateExpiration = (int) ChronoUnit.MINUTES.between(FBUtilities.now(), notAfter.toInstant());
        int certificateValidityPeriodMinutes = certificateValidityPeriodInMinutes(x509Certificates[0]);
        if (certificateValidityPeriodMinutes > maxCertificateValidityPeriodMinutes)
        {
            String errorMessage = String.format("The validity period of the provided certificate (%s) exceeds " +
                                                "the maximum allowed validity period of %s",
                                                MutualTlsUtil.toHumanReadableCertificateExpiration(certificateValidityPeriodMinutes),
                                                MutualTlsUtil.toHumanReadableCertificateExpiration(maxCertificateValidityPeriodMinutes));
            throw new AuthenticationException(errorMessage);
        }

        return minutesToCertificateExpiration;
    }

    int certificateValidityPeriodInMinutes(X509Certificate certificate)
    {
        return (int) ChronoUnit.MINUTES.between(certificate.getNotBefore().toInstant(),
                                                certificate.getNotAfter().toInstant());
    }
}

View on GitHub (pinned to 88fd0f6a0e)