apache/seatunnel · error · CertificateExpiredException

KeyStore certificate is expired:

Error message

KeyStore certificate is expired: 

What it means

During createSSLContext, SSLUtils.validateCertificates walks every certificate in the configured KeyStore and calls checkValidity(). If a certificate's notAfter date is in the past, CertificateExpiredException is caught and rethrown with the message "KeyStore certificate is expired: <detail>" so the SSL/TLS handshake fails fast with a clear cause instead of an opaque handshake error.

Source

Thrown at seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/util/SSLUtils.java:157

            trustStore.load(in, trustStorePassword.map(String::toCharArray).orElse(null));
        }
        return trustStore;
    }

    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }
            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {
                ((X509Certificate) certificate).checkValidity();
            } catch (CertificateExpiredException e) {
                throw new CertificateExpiredException(
                        "KeyStore certificate is expired: " + e.getMessage());
            } catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException(
                        "KeyStore certificate is not yet valid: " + e.getMessage());
            }
        }
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

1. Renew the expired certificate and import the new one into the keystore: keytool -importcert -file new-cert.cer -keystore keystore.jks -alias <alias>.
2. Check expiry with keytool -list -v -keystore keystore.jks and replace all entries whose notAfter date has passed.
3. Set up certificate rotation/monitoring so certificates are refreshed before expiry.
4. If the keystore contains the server's CA chain, ensure the root/intermediate CAs themselves have not expired.

Example fix

// before: expired cert in keystore.jks
// after: regenerate and re-import
// openssl x509 -req -in es.csr -CA ca.crt -CAkey ca.key -days 365 -out es-new.cer
// keytool -delete -alias elasticsearch -keystore keystore.jks
// keytool -importcert -alias elasticsearch -file es-new.cer -keystore keystore.jks

// Check all keystore certificates for expiry before building the SSL context
Enumeration<String> aliases = trustStore.aliases();
while (aliases.hasMoreElements()) {
    java.security.cert.Certificate c = trustStore.getCertificate(aliases.nextElement());
    if (c instanceof X509Certificate) {
        ((X509Certificate) c).checkValidity(); // throws CertificateExpiredException if expired
    }
}

try {
    SSLContext ctx = SSLUtils.buildSSLContext(trustStore, keyStore, password);
} catch (CertificateExpiredException e) {
    log.error("Keystore certificate expired, renew and re-import: " + e.getMessage());
    throw e;
}

When it happens

Trigger: Creating an SSL context for an HTTPS Elasticsearch connection when any X509Certificate in the configured keystore/truststore has an expiry (notAfter) date earlier than the current time.

Common situations: Long-running deployments where a previously valid self-signed or internal CA certificate expired; stale keystores shipped with old config; certificates with short lifetimes (e.g. 90-day) not rotated.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Could not load keystore
• KeyStore certificate is expired:
• Failed to configure TLS settings
• Unexpected default trust managers:
• KeyStore certificate is not yet valid:

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/5fca64d586ea0c3d. Report an issue: GitHub.