apache/seatunnel · error · CertificateNotYetValidException

KeyStore certificate is not yet valid:

Error message

KeyStore certificate is not yet valid: 

What it means

During createSSLContext, SSLUtils.validateCertificates calls checkValidity() on each KeyStore certificate. If a certificate's notBefore date is in the future (not yet valid), CertificateNotYetValidException is caught and rethrown as "KeyStore certificate is not yet valid: <detail>". This surfaces clock-skew or prematurely deployed certificates at SSL context creation time.

Source

Thrown at seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/util/SSLUtils.java:160

    }

    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }
            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {
                ((X509Certificate) certificate).checkValidity();
            } catch (CertificateExpiredException e) {
                throw new CertificateExpiredException(
                        "KeyStore certificate is expired: " + e.getMessage());
            } catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException(
                        "KeyStore certificate is not yet valid: " + e.getMessage());
            }
        }
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

1. Check the system clock on the client machine (date / timedatectl) and enable NTP time sync; wrong clock is the most common cause.
2. Verify certificate validity window with keytool -list -v -keystore keystore.jks or openssl x509 -noout -dates -in cert.pem.
3. If the certificate is genuinely premature, obtain or wait for the correctly valid certificate and re-import it.
4. Regenerate a self-signed certificate with a validity period covering now: keytool -genkeypair -validity 365 ...

Example fix

// before: cert notBefore in the future due to clock skew
// after: sync clock and re-check
// timedatectl set-ntp true
// openssl x509 -noout -dates -in es.cer  # confirm notBefore < now

// Check certificate validity windows before building the SSL context
X509Certificate cert = (X509Certificate) trustStore.getCertificate(alias);
cert.checkValidity(); // throws CertificateNotYetValidException if notBefore is in the future
System.out.println("valid from " + cert.getNotBefore() + " to " + cert.getNotAfter());

try {
    SSLContext ctx = SSLUtils.buildSSLContext(trustStore, keyStore, password);
} catch (CertificateNotYetValidException e) {
    log.error("Certificate not yet valid — check system clock or cert validity dates: " + e.getMessage());
    throw e;
}

When it happens

Trigger: Creating an SSL context when any X509Certificate in the configured keystore has a notBefore validity start date later than the current system time.

Common situations: Deploying a certificate before its validity start date; significant clock skew between client and certificate authority (wrong system time in VM/container); accidentally importing a not-yet-activated certificate.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to configure TLS settings
• Unexpected default trust managers:
• KeyStore certificate is expired:
• Could not load keystore
• Could not load truststore

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/9e708d57b40a3677. Report an issue: GitHub.