{"record":{"id":"857b49a8e87172c1","repo":"prestodb/presto","slug":"keystore-certificate-is-expired-857b49","errorCode":null,"errorMessage":"KeyStore certificate is expired: ","messagePattern":"KeyStore certificate is expired: ","errorType":"exception","errorClass":"CertificateExpiredException","httpStatus":null,"severity":"critical","filePath":"presto-elasticsearch/src/main/java/com/facebook/presto/elasticsearch/client/ElasticsearchClient.java","lineNumber":390,"sourceCode":"        return trustStore;\n    }\n\n    private static void validateCertificates(KeyStore keyStore)\n            throws GeneralSecurityException\n    {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n            try {\n                ((X509Certificate) certificate).checkValidity();\n            }\n            catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\"KeyStore certificate is expired: \" + e.getMessage());\n            }\n            catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\"KeyStore certificate is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n\n    private Set<ElasticsearchNode> fetchNodes()\n    {\n        NodesResponse nodesResponse = doRequest(\"/_nodes/http\", NODES_RESPONSE_CODEC::fromJson);\n\n        ImmutableSet.Builder<ElasticsearchNode> result = ImmutableSet.builder();\n        for (Map.Entry<String, NodesResponse.Node> entry : nodesResponse.getNodes().entrySet()) {\n            String nodeId = entry.getKey();\n            NodesResponse.Node node = entry.getValue();\n\n            if (node.getRoles().contains(\"data\")) {\n                Optional<String> address = node.getAddress()","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-elasticsearch/src/main/java/com/facebook/presto/elasticsearch/client/ElasticsearchClient.java#L372-L408","documentation":"validateCertificates walks the entries of the configured truststore and calls X509Certificate.checkValidity() on each. If a certificate's notAfter date has passed, it throws CertificateExpiredException wrapping the original message. The connector refuses to build an SSL context with expired trust material, even if other certificates in the store are still valid.","triggerScenarios":"The truststore (or keystore) supplied via elasticsearch.security.truststore/keystore contains a certificate whose validity window has ended; this runs once at client/SSL context construction (buildSslContext).","commonSituations":"Long-lived clusters where the intermediate/root CA expired; certificates provisioned a year+ ago and never rotated; clocks wrong on the Presto coordinator (though usually it is truly expired).","solutions":["Renew the Elasticsearch server/CA certificate and rebuild the truststore with the new CA.","Identify the expired entry with keytool -list -v and delete it if it is no longer needed.","Set up certificate rotation/monitoring before expiry.","If a clock issue, fix the host NTP/time settings."],"exampleFix":"// before: truststore contains ca.crt expired 2025-01-01\n// after: import renewed CA\nkeytool -delete -alias es-ca -keystore truststore.jks\nkeytool -importcert -alias es-ca -file new-ca.crt -keystore truststore.jks","handlingStrategy":"validation","validationCode":"// check expiry before deployment\nkeytool -list -v -keystore truststore.jks | grep -A2 'Valid from'\n# or programmatically:\n// X509Certificate c = ...; c.checkValidity(); // throws if expired","typeGuard":null,"tryCatchPattern":"try {\n    client = new ElasticsearchClient(...);\n} catch (CertificateExpiredException e) {\n    alert(\"ES truststore certificate expired: \" + e.getMessage());\n    throw e; // do not silently continue with expired trust\n}","preventionTips":["Monitor certificate expiry (e.g. SSL checks, cert-manager alerts) 30 days ahead.","Rotate CA/server certificates on a schedule and rebuild the truststore.","Keep NTP synchronized on Presto coordinators to avoid false positives."],"tags":["elasticsearch","ssl","certificate-expired","tls"],"backgroundTag":"certificate-expired","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}