apache/seatunnel · critical · CertificateExpiredException

KeyStore certificate is expired:

Error message

KeyStore certificate is expired: 

What it means

SSLUtils.validateCertificates iterates the keystore entries and calls X509Certificate.checkValidity() against the current clock; a CertificateExpiredException is rethrown as 'KeyStore certificate is expired: <detail>'. The configured certificate chain used for the Easysearch TLS connection has passed its notAfter date.

Source

Thrown at seatunnel-connectors-v2/connector-easysearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/easysearch/util/SSLUtils.java:157

            trustStore.load(in, trustStorePassword.map(String::toCharArray).orElse(null));
        }
        return trustStore;
    }

    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }
            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {
                ((X509Certificate) certificate).checkValidity();
            } catch (CertificateExpiredException e) {
                throw new CertificateExpiredException(
                        "KeyStore certificate is expired: " + e.getMessage());
            } catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException(
                        "KeyStore certificate is not yet valid: " + e.getMessage());
            }
        }
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

1. Renew the certificate and import the new one into the keystore (keytool -importcert -file new.crt -keystore ...).
2. Verify expiry with keytool -list -v -keystore ... | grep until and rotate before it lapses.
3. Regenerate self-signed certs (keytool -genkeypair) with a longer validity if appropriate.
4. As a temporary dev-only workaround, disable verification per connector TLS options — never in production.

Example fix

// before: expired cert in truststore
keytool -importcert -keystore es.jks -file old.crt
// after
keytool -list -v -keystore es.jks   # confirm notAfter
keytool -importcert -keystore es.jks -file renewed.crt -alias es

// shell: check expiry before running the job
keytool -list -v -keystore es.jks | grep -A1 'Alias name' | grep until
# or programmatically:
// ((X509Certificate) ks.getCertificate(alias)).checkValidity();

try { sslContext = SSLUtils.createSSLContext(ks); } catch (CertificateExpiredException e) { log.error("Keystore cert expired: {} — rotate the certificate", e.getMessage()); throw e; }

When it happens

Trigger: createSSLContext -> validateCertificates finds an X509 certificate in the keystore whose validity period has ended (now > notAfter).

Common situations: Self-signed or internally-issued certs not rotated on schedule; long-running clusters whose 1-year certs lapsed; importing a stale dev keystore into production config.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Unexpected default trust managers:
• KeyStore certificate is not yet valid:
• KeyStore certificate is expired:
• Could not load keystore
• Could not load truststore

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/a299fbf4f3f7087c. Report an issue: GitHub.