{"record":{"id":"7b16261671c2486b","repo":"prestodb/presto","slug":"keystore-certificate-is-expired","errorCode":null,"errorMessage":"KeyStore certificate is expired: ","messagePattern":"KeyStore certificate is expired: ","errorType":"validation","errorClass":"CertificateExpiredException","httpStatus":null,"severity":"error","filePath":"presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java","lineNumber":265,"sourceCode":"    }\n\n    private static void validateCertificates(KeyStore keyStore)\n            throws GeneralSecurityException\n    {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {\n                ((X509Certificate) certificate).checkValidity();\n            }\n            catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\"KeyStore certificate is expired: \" + e.getMessage());\n            }\n            catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\"KeyStore certificate is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n\n    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword, String trustStoreType)\n            throws IOException, GeneralSecurityException\n    {\n        KeyStore trustStore = KeyStore.getInstance(trustStoreType);\n        try {\n            // attempt to read the trust store as a PEM file\n            List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);\n            if (!certificateChain.isEmpty()) {\n                trustStore.load(null, null);\n                for (X509Certificate certificate : certificateChain) {\n                    X500Principal principal = certificate.getSubjectX500Principal();","sourceCodeStart":247,"sourceCodeEnd":283,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java#L247-L283","documentation":"validateCertificates iterates every certificate in the keystore and calls checkValidity(); if a certificate's notAfter date has passed, it rethrows as CertificateExpiredException with the prefix 'KeyStore certificate is expired: '. This is a proactive check so TLS failures are reported clearly before any request is made instead of failing opaquely during the handshake.","triggerScenarios":"setupSsl -> validateCertificates on a KeyStore containing an X509Certificate whose validity period has ended (current date > notAfter).","commonSituations":"Long-lived Presto CLI/JDBC client deployments where the server CA or client certificate expired; forgetting to rotate certificates; copying an old keystore into a new environment.","solutions":["Renew the expired certificate and import the new one into the keystore (keytool -importcert).","Identify the expired entry with keytool -list -v and its expiration date.","Set up expiration monitoring/renewal (e.g. certmgr or scheduled keytool checks).","If it is a server CA chain update, import the renewed CA certificate into the trust store."],"exampleFix":"// before\nkeytool -list -v -keystore truststore.jks  // entry expires 2025-01-01\n// after\nkeytool -importcert -alias server-ca -file renewed-ca.crt -keystore truststore.jks","handlingStrategy":"validation","validationCode":"Enumeration<String> aliases = keyStore.aliases();\nwhile (aliases.hasMoreElements()) {\n    java.security.cert.Certificate c = keyStore.getCertificate(aliases.nextElement());\n    if (c instanceof X509Certificate) ((X509Certificate) c).checkValidity();  // throws CertificateExpiredException early\n}","typeGuard":null,"tryCatchPattern":"try { buildClient(...); } catch (ClientException e) { if (e.getCause() instanceof CertificateExpiredException) { /* renew cert, reload keystore */ } throw e; }","preventionTips":["Monitor certificate expiration dates (keytool -list -v or cert monitoring tools)","Automate cert renewal before notAfter","Version-control keystore rotation procedures"],"tags":["ssl","certificate-expired","keystore"],"backgroundTag":"certificate-expired","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}