{"record":{"id":"5fca64d586ea0c3d","repo":"apache/seatunnel","slug":"keystore-certificate-is-expired-5fca64","errorCode":null,"errorMessage":"KeyStore certificate is expired: ","messagePattern":"KeyStore certificate is expired: ","errorType":"exception","errorClass":"CertificateExpiredException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/util/SSLUtils.java","lineNumber":157,"sourceCode":"            trustStore.load(in, trustStorePassword.map(String::toCharArray).orElse(null));\n        }\n        return trustStore;\n    }\n\n    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {\n                ((X509Certificate) certificate).checkValidity();\n            } catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\n                        \"KeyStore certificate is expired: \" + e.getMessage());\n            } catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\n                        \"KeyStore certificate is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n}\n","sourceCodeStart":139,"sourceCodeEnd":166,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/util/SSLUtils.java#L139-L166","documentation":"During createSSLContext, SSLUtils.validateCertificates walks every certificate in the configured KeyStore and calls checkValidity(). If a certificate's notAfter date is in the past, CertificateExpiredException is caught and rethrown with the message \"KeyStore certificate is expired: <detail>\" so the SSL/TLS handshake fails fast with a clear cause instead of an opaque handshake error.","triggerScenarios":"Creating an SSL context for an HTTPS Elasticsearch connection when any X509Certificate in the configured keystore/truststore has an expiry (notAfter) date earlier than the current time.","commonSituations":"Long-running deployments where a previously valid self-signed or internal CA certificate expired; stale keystores shipped with old config; certificates with short lifetimes (e.g. 90-day) not rotated.","solutions":["Renew the expired certificate and import the new one into the keystore: keytool -importcert -file new-cert.cer -keystore keystore.jks -alias <alias>.","Check expiry with keytool -list -v -keystore keystore.jks and replace all entries whose notAfter date has passed.","Set up certificate rotation/monitoring so certificates are refreshed before expiry.","If the keystore contains the server's CA chain, ensure the root/intermediate CAs themselves have not expired."],"exampleFix":"// before: expired cert in keystore.jks\n// after: regenerate and re-import\n// openssl x509 -req -in es.csr -CA ca.crt -CAkey ca.key -days 365 -out es-new.cer\n// keytool -delete -alias elasticsearch -keystore keystore.jks\n// keytool -importcert -alias elasticsearch -file es-new.cer -keystore keystore.jks","handlingStrategy":"validation","validationCode":"// Check all keystore certificates for expiry before building the SSL context\nEnumeration<String> aliases = trustStore.aliases();\nwhile (aliases.hasMoreElements()) {\n    java.security.cert.Certificate c = trustStore.getCertificate(aliases.nextElement());\n    if (c instanceof X509Certificate) {\n        ((X509Certificate) c).checkValidity(); // throws CertificateExpiredException if expired\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    SSLContext ctx = SSLUtils.buildSSLContext(trustStore, keyStore, password);\n} catch (CertificateExpiredException e) {\n    log.error(\"Keystore certificate expired, renew and re-import: \" + e.getMessage());\n    throw e;\n}","preventionTips":["Monitor certificate expiry dates with a scheduled keytool -list -v check or a cert-monitoring tool.","Prefer certificates with long validity for internal CAs or automate rotation (e.g. cert-manager).","Validate keystores in CI/deployment scripts before shipping them to production."],"tags":["ssl","certificate-expired","elasticsearch","keystore"],"backgroundTag":"jwt-token-expired","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}