{"record":{"id":"34869d8b9a56b74e","repo":"prestodb/presto","slug":"keystore-certificate-is-not-yet-valid-e-getmess","errorCode":null,"errorMessage":"KeyStore certificate is not yet valid: ${e.getMessage()}","messagePattern":"KeyStore certificate is not yet valid: (.+?)","errorType":"exception","errorClass":"CertificateNotYetValidException","httpStatus":null,"severity":"critical","filePath":"presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/HiveMetastoreClientFactory.java","lineNumber":223,"sourceCode":"            throws GeneralSecurityException\n    {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n            final Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {\n                ((X509Certificate) certificate).checkValidity();\n            }\n            catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\"KeyStore certificate is expired: \" + e.getMessage());\n            }\n            catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\"KeyStore certificate is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n}\n","sourceCodeStart":205,"sourceCodeEnd":228,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/HiveMetastoreClientFactory.java#L205-L228","documentation":"Thrown by HiveMetastoreClientFactory.validateKeyStoreCertificates when an X509 certificate's notBefore date is in the future, i.e. checkValidity() raises CertificateNotYetValidException. The factory refuses to build the SSL context with a certificate that is not yet valid, since the TLS peer would reject it anyway.","triggerScenarios":"Creating the Hive metastore client with a keystore whose certificate validity has not started — typically caused by clock skew or a pre-issued certificate placed into use too early.","commonSituations":"Presto node system clock wrong (NTP not running, VM restored from snapshot); certificate issued for a future start date and deployed ahead of schedule; timezone/clock drift in containers without an ntp daemon.","solutions":["Sync the machine clock: enable and start ntpd/chronyd (chrony sources, timedatectl set-ntp true) and verify with `date -u` against a reliable time source","Confirm the certificate's notBefore date with `keytool -list -v -keystore keystore.jks`; if deployed early, redeploy on/after that date","If the certificate is simply misissued, request a reissued certificate with a correct validity window","Check for hypervisor/VM clock drift after suspend-resume and reset with hwclock -s"],"exampleFix":"// before\nthrow new CertificateNotYetValidException(\"KeyStore certificate is not yet valid: \" + e.getMessage());\n// after\n# fix clock skew, then restart\n# sudo systemctl enable --now chronyd\n# verify: openssl x509 -in cert.pem -noout -dates","handlingStrategy":"validation","validationCode":"import java.io.*;\nimport java.security.*;\nimport java.security.cert.*;\nimport java.util.*;\n\npublic static void checkNotBeforeDates(String keystorePath, char[] password) throws GeneralSecurityException, IOException {\n    KeyStore ks = KeyStore.getInstance(\"JKS\");\n    try (InputStream in = new FileInputStream(keystorePath)) {\n        ks.load(in, password);\n    }\n    Date now = new Date();\n    for (Enumeration<String> e = ks.aliases(); e.hasMoreElements(); ) {\n        Certificate c = ks.getCertificate(e.nextElement());\n        if (c instanceof X509Certificate) {\n            ((X509Certificate) c).checkValidity(now); // throws CertificateNotYetValidException if notBefore > now\n        }\n    }\n}","typeGuard":"public static boolean isNotYetValid(X509Certificate cert) {\n    try { cert.checkValidity(); return false; }\n    catch (CertificateNotYetValidException e) { return true; }\n    catch (CertificateExpiredException e) { return false; }\n}","tryCatchPattern":"try {\n    createHiveMetastoreClient(config);\n} catch (CertificateNotYetValidException e) {\n    log.error(\"Cert not yet valid — check system clock and cert notBefore date\", e);\n    throw new ConfigurationException(\"Synchronize NTP or deploy certificate on/after its notBefore date\");\n}","preventionTips":["Run NTP/chrony on all Presto nodes and monitor clock skew","Verify notBefore/notAfter with openssl x509 -noout -dates before deploying certificates","Deploy certificates only on or after their validity start; automate deployment windows","After VM snapshot restore or suspend, verify system time before restarting services"],"tags":["ssl","keystore","certificate-not-yet-valid","clock-skew","hive-metastore"],"backgroundTag":"certificate-expired","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}