{"record":{"id":"0c09d4e2911aedd0","repo":"prestodb/presto","slug":"keystore-certificate-is-not-yet-valid","errorCode":null,"errorMessage":"KeyStore certificate is not yet valid: ","messagePattern":"KeyStore certificate is not yet valid: ","errorType":"validation","errorClass":"CertificateNotYetValidException","httpStatus":null,"severity":"error","filePath":"presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java","lineNumber":268,"sourceCode":"            throws GeneralSecurityException\n    {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {\n                ((X509Certificate) certificate).checkValidity();\n            }\n            catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\"KeyStore certificate is expired: \" + e.getMessage());\n            }\n            catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\"KeyStore certificate is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n\n    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword, String trustStoreType)\n            throws IOException, GeneralSecurityException\n    {\n        KeyStore trustStore = KeyStore.getInstance(trustStoreType);\n        try {\n            // attempt to read the trust store as a PEM file\n            List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);\n            if (!certificateChain.isEmpty()) {\n                trustStore.load(null, null);\n                for (X509Certificate certificate : certificateChain) {\n                    X500Principal principal = certificate.getSubjectX500Principal();\n                    trustStore.setCertificateEntry(principal.getName(), certificate);\n                }\n                return trustStore;","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java#L250-L286","documentation":"In the same validateCertificates loop, checkValidity() throwing CertificateNotYetValidException means a certificate's notBefore date is in the future; the code rethrows with the prefix 'KeyStore certificate is not yet valid: '. The keystore contains a certificate that is not yet usable at the current system time.","triggerScenarios":"setupSsl -> validateCertificates encounters an X509Certificate whose notBefore date is after the client machine's current clock time.","commonSituations":"Client machine clock skew (wrong date/timezone, VM restored from snapshot); a newly issued certificate imported before its validity start; NTP not running.","solutions":["Sync the system clock (enable NTP: chrony/ntpd, timedatectl set-ntp true).","Check the certificate's notBefore date with keytool -list -v.","Re-import the certificate after its validity window starts, or obtain one valid now.","Fix VM/host clock drift after snapshot restores."],"exampleFix":"// before\n$ date  # shows 2020-01-01, real date 2026-09-03\n// after\n$ timedatectl set-ntp true && chronyc makestep","handlingStrategy":"validation","validationCode":"X509Certificate cert = (X509Certificate) keyStore.getCertificate(alias);\nif (cert.getNotBefore().after(new Date())) {\n    throw new IllegalStateException(\"Certificate not valid until \" + cert.getNotBefore());\n}","typeGuard":null,"tryCatchPattern":"try { buildClient(...); } catch (ClientException e) { if (e.getCause() instanceof CertificateNotYetValidException) { /* sync clock or fix cert */ } throw e; }","preventionTips":["Run NTP time sync on all client hosts","Verify clock after VM snapshot restores","Check notBefore dates when importing new certificates"],"tags":["ssl","certificate","clock-skew"],"backgroundTag":"certificate-not-yet-valid","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}