apache/seatunnel · critical · CertificateNotYetValidException

KeyStore certificate is not yet valid:

Error message

KeyStore certificate is not yet valid: 

What it means

Same validation path as 928: SSLUtils.validateCertificates catches CertificateNotYetValidException from X509Certificate.checkValidity() and rethrows 'KeyStore certificate is not yet valid: <detail>'. The certificate's notBefore date is in the future relative to the machine clock, so the JDK refuses to use it.

Source

Thrown at seatunnel-connectors-v2/connector-easysearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/easysearch/util/SSLUtils.java:160

    }

    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }
            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {
                ((X509Certificate) certificate).checkValidity();
            } catch (CertificateExpiredException e) {
                throw new CertificateExpiredException(
                        "KeyStore certificate is expired: " + e.getMessage());
            } catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException(
                        "KeyStore certificate is not yet valid: " + e.getMessage());
            }
        }
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

1. Sync system time (chrony/ntpdate) on the SeaTunnel node and re-run the job.
2. Check the cert's notBefore with keytool -list -v and use a cert valid at current time.
3. Re-issue the certificate if it was generated on a machine with a wrong (future) clock.
4. Investigate repeated clock drift on VMs/containers and add time-sync monitoring.

Example fix

// before: node clock 2023-01-01, cert notBefore 2024-06-01
sudo ntpdate pool.ntp.org
// after: clock synced, checkValidity passes

// Java/shell: verify clock and cert notBefore
date   # confirm system time is current
keytool -list -v -keystore es.jks | grep -i before

try { sslContext = SSLUtils.createSSLContext(ks); } catch (CertificateNotYetValidException e) { log.error("Cert not yet valid (clock skew or bad cert): {} — sync NTP and re-issue", e.getMessage()); throw e; }

When it happens

Trigger: createSSLContext -> validateCertificates encounters an X509 certificate whose validity has not started (now < notBefore).

Common situations: Severely skewed system clock (VM resumed, NTP not synced, wrong timezone/BIOS clock); newly issued certs distributed before their notBefore; generating certs on a machine with a future clock and deploying to one with a correct clock.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Unexpected default trust managers:
• KeyStore certificate is expired:
• Could not load keystore
• Could not load truststore
• Failed to open catalog ${catalogName}

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/a00f451087cdf284. Report an issue: GitHub.