{"record":{"id":"65b4bd89130e16c3","repo":"prestodb/presto","slug":"keystore-certificate-is-not-yet-valid-65b4bd","errorCode":null,"errorMessage":"KeyStore certificate is not yet valid: ","messagePattern":"KeyStore certificate is not yet valid: ","errorType":"exception","errorClass":"CertificateNotYetValidException","httpStatus":null,"severity":"critical","filePath":"presto-elasticsearch/src/main/java/com/facebook/presto/elasticsearch/client/ElasticsearchClient.java","lineNumber":393,"sourceCode":"    private static void validateCertificates(KeyStore keyStore)\n            throws GeneralSecurityException\n    {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n            try {\n                ((X509Certificate) certificate).checkValidity();\n            }\n            catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\"KeyStore certificate is expired: \" + e.getMessage());\n            }\n            catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\"KeyStore certificate is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n\n    private Set<ElasticsearchNode> fetchNodes()\n    {\n        NodesResponse nodesResponse = doRequest(\"/_nodes/http\", NODES_RESPONSE_CODEC::fromJson);\n\n        ImmutableSet.Builder<ElasticsearchNode> result = ImmutableSet.builder();\n        for (Map.Entry<String, NodesResponse.Node> entry : nodesResponse.getNodes().entrySet()) {\n            String nodeId = entry.getKey();\n            NodesResponse.Node node = entry.getValue();\n\n            if (node.getRoles().contains(\"data\")) {\n                Optional<String> address = node.getAddress()\n                        .flatMap(ElasticsearchClient::extractAddress);\n\n                result.add(new ElasticsearchNode(nodeId, address));","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-elasticsearch/src/main/java/com/facebook/presto/elasticsearch/client/ElasticsearchClient.java#L375-L411","documentation":"validateCertificates calls X509Certificate.checkValidity() on each truststore entry; if the current date is before the certificate's notBefore date, it throws CertificateNotYetValidException. The SSL context cannot be built with certificates that are not yet valid. This mirrors the expired-certificate path but fires for future-dated certificates.","triggerScenarios":"A certificate in the configured truststore/keystore has a notBefore date later than the current system time; thrown during buildSslContext at client initialization.","commonSituations":"Certificates generated with wrong system clock (host clock set far in the past when cert was created); staged rollout of renewed certs loaded too early; time skew after VM snapshot restore.","solutions":["Fix the host clock / NTP sync if time skew is the cause.","Use the final (not pre-issued) certificate in the truststore.","Regenerate the certificate with a notBefore date at or before now.","Check the entry with keytool -list -v and replace future-dated certs."],"exampleFix":"// before: cert notBefore=2027-01-01 (bad clock when generated)\n// after: regenerate on a host with correct time, then\nkeytool -importcert -alias es-ca -file ca.crt -keystore truststore.jks","handlingStrategy":"validation","validationCode":"// verify validity window before use\nkeytool -list -v -keystore truststore.jks | grep -A1 'Valid from'\n// ensure 'Valid from' start date <= current date","typeGuard":null,"tryCatchPattern":"try {\n    client = new ElasticsearchClient(...);\n} catch (CertificateNotYetValidException e) {\n    log.error(\"Cert not yet valid — check host clock or cert notBefore: \" + e.getMessage());\n    throw e;\n}","preventionTips":["Generate certificates only on hosts with correct, NTP-synced clocks.","Validate new certificates' notBefore date immediately after issuance.","Avoid snapshot-restore clock skew; resync time after restore."],"tags":["elasticsearch","ssl","certificate-not-yet-valid","clock-skew"],"backgroundTag":"certificate-not-yet-valid","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}