{"record":{"id":"362ea4424b6ee5c8","repo":"prestodb/presto","slug":"keystore-certificate-s-is-not-yet-valid","errorCode":null,"errorMessage":"KeyStore certificate '%s' is not yet valid: ","messagePattern":"KeyStore certificate '(.+?)' is not yet valid: ","errorType":"exception","errorClass":"CertificateNotYetValidException","httpStatus":null,"severity":"error","filePath":"presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java","lineNumber":284,"sourceCode":"        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {\n                ((X509Certificate) certificate).checkValidity();\n                log.debug(\"Certificate '{}' is valid\", alias);\n            }\n            catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\"KeyStore certificate '\" + alias + \"' is expired: \" + e.getMessage());\n            }\n            catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\"KeyStore certificate '\" + alias + \"' is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n}\n","sourceCodeStart":266,"sourceCodeEnd":289,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java#L266-L289","documentation":"The counterpart of the expiry check: validateCertificates calls X509Certificate.checkValidity(), and if the certificate's notBefore date is in the future, CertificateNotYetValidException is rethrown with the offending alias. The keystore is rejected at load time because TLS peers would reject certs that are not yet valid.","triggerScenarios":"loadKeyStore -> validateCertificates encounters an X509Certificate whose notBefore date is later than the current system time — e.g. a cert issued with a future start date or a badly skewed local clock.","commonSituations":"Clock skew (VM resumed from snapshot, RTC battery failure, wrong timezone/UTC mismatch), a certificate issued ahead of schedule during rotation and deployed too early, or certificates generated with wrong validity windows by automation.","solutions":["Sync system time (chronyd/ntpd, enable NTP in the container host) and restart the connector","Wait until the certificate's notBefore date if the rotation was deployed early","Reissue the certificate with a correct validity window from your CA","Verify with: keytool -list -v -keystore keystore.jks and check the 'Valid from' line for the named alias"],"exampleFix":"// before\n# deploy new cert immediately after issuance\n// after\n# verify notBefore has passed before deploying:\n# openssl x509 -in cert.pem -noout -dates","handlingStrategy":"validation","validationCode":"java\nX509Certificate cert = ...;\nDate now = new Date();\nif (cert.getNotBefore().after(now)) {\n    throw new IllegalStateException(\"Cert not valid until \" + cert.getNotBefore());\n}","typeGuard":"java\nstatic boolean notYetValid(X509Certificate c) {\n    return c.getNotBefore().after(new Date());\n}","tryCatchPattern":"java\ntry {\n    sslContext = provider.createSSLContext(config);\n} catch (CertificateNotYetValidException e) {\n    log.error(\"Certificate not yet valid (check clocks / early deploy): \" + e.getMessage());\n    throw e;\n}","preventionTips":["Enable NTP and monitor clock skew on all hosts","Verify openssl x509 -noout -dates before deploying rotated certificates","Deploy new certificates only after their notBefore date has passed","Sync time after restoring VMs from snapshots before starting services"],"tags":["ssl","certificate-validity","keystore","clock-skew"],"backgroundTag":"certificate-not-yet-valid","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}