{"record":{"id":"09dfa5170239d034","repo":"apache/cassandra","slug":"the-validity-period-of-the-provided-certificate","errorCode":null,"errorMessage":"The validity period of the provided certificate (%s) exceeds the maximum allowed validity period of %s","messagePattern":"The validity period of the provided certificate \\((.+?)\\) exceeds the maximum allowed validity period of (.+?)","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/MutualTlsCertificateValidityPeriodValidator.java","lineNumber":75,"sourceCode":"    public int validate(Certificate[] certificates) throws AuthenticationException\n    {\n        X509Certificate[] x509Certificates = MutualTlsUtil.castCertsToX509(certificates);\n        if (x509Certificates == null || x509Certificates.length == 0)\n        {\n            return -1;\n        }\n\n        Date notAfter = x509Certificates[0].getNotAfter();\n\n        int minutesToCertificateExpiration = (int) ChronoUnit.MINUTES.between(FBUtilities.now(), notAfter.toInstant());\n        int certificateValidityPeriodMinutes = certificateValidityPeriodInMinutes(x509Certificates[0]);\n        if (certificateValidityPeriodMinutes > maxCertificateValidityPeriodMinutes)\n        {\n            String errorMessage = String.format(\"The validity period of the provided certificate (%s) exceeds \" +\n                                                \"the maximum allowed validity period of %s\",\n                                                MutualTlsUtil.toHumanReadableCertificateExpiration(certificateValidityPeriodMinutes),\n                                                MutualTlsUtil.toHumanReadableCertificateExpiration(maxCertificateValidityPeriodMinutes));\n            throw new AuthenticationException(errorMessage);\n        }\n\n        return minutesToCertificateExpiration;\n    }\n\n    int certificateValidityPeriodInMinutes(X509Certificate certificate)\n    {\n        return (int) ChronoUnit.MINUTES.between(certificate.getNotBefore().toInstant(),\n                                                certificate.getNotAfter().toInstant());\n    }\n}\n","sourceCodeStart":57,"sourceCodeEnd":87,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsCertificateValidityPeriodValidator.java#L57-L87","documentation":"AuthenticationException from MutualTlsCertificateValidityPeriodValidator.validate: the leaf certificate's total validity period (notAfter minus notBefore) exceeds the configured maximum allowed certificate age. This guards against long-lived certificates; the message reports the certificate's period and the configured maximum. Returns -1 (no-op) for empty/non-X509 input instead of throwing.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/MutualTlsCertificateValidityPeriodValidator.java:75 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reissue the certificate with a shorter validity period within the configured maximum","Raise the maximum allowed certificate age configuration if the longer period is intentional","Track certificate renewal so short-lived certificates can be rotated before expiry"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}