{"record":{"id":"9e708d57b40a3677","repo":"apache/seatunnel","slug":"keystore-certificate-is-not-yet-valid-9e708d","errorCode":null,"errorMessage":"KeyStore certificate is not yet valid: ","messagePattern":"KeyStore certificate is not yet valid: ","errorType":"exception","errorClass":"CertificateNotYetValidException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/util/SSLUtils.java","lineNumber":160,"sourceCode":"    }\n\n    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {\n                ((X509Certificate) certificate).checkValidity();\n            } catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\n                        \"KeyStore certificate is expired: \" + e.getMessage());\n            } catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\n                        \"KeyStore certificate is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n}\n","sourceCodeStart":142,"sourceCodeEnd":166,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/util/SSLUtils.java#L142-L166","documentation":"During createSSLContext, SSLUtils.validateCertificates calls checkValidity() on each KeyStore certificate. If a certificate's notBefore date is in the future (not yet valid), CertificateNotYetValidException is caught and rethrown as \"KeyStore certificate is not yet valid: <detail>\". This surfaces clock-skew or prematurely deployed certificates at SSL context creation time.","triggerScenarios":"Creating an SSL context when any X509Certificate in the configured keystore has a notBefore validity start date later than the current system time.","commonSituations":"Deploying a certificate before its validity start date; significant clock skew between client and certificate authority (wrong system time in VM/container); accidentally importing a not-yet-activated certificate.","solutions":["Check the system clock on the client machine (date / timedatectl) and enable NTP time sync; wrong clock is the most common cause.","Verify certificate validity window with keytool -list -v -keystore keystore.jks or openssl x509 -noout -dates -in cert.pem.","If the certificate is genuinely premature, obtain or wait for the correctly valid certificate and re-import it.","Regenerate a self-signed certificate with a validity period covering now: keytool -genkeypair -validity 365 ..."],"exampleFix":"// before: cert notBefore in the future due to clock skew\n// after: sync clock and re-check\n// timedatectl set-ntp true\n// openssl x509 -noout -dates -in es.cer  # confirm notBefore < now","handlingStrategy":"validation","validationCode":"// Check certificate validity windows before building the SSL context\nX509Certificate cert = (X509Certificate) trustStore.getCertificate(alias);\ncert.checkValidity(); // throws CertificateNotYetValidException if notBefore is in the future\nSystem.out.println(\"valid from \" + cert.getNotBefore() + \" to \" + cert.getNotAfter());","typeGuard":null,"tryCatchPattern":"try {\n    SSLContext ctx = SSLUtils.buildSSLContext(trustStore, keyStore, password);\n} catch (CertificateNotYetValidException e) {\n    log.error(\"Certificate not yet valid — check system clock or cert validity dates: \" + e.getMessage());\n    throw e;\n}","preventionTips":["Enable NTP time synchronization on all worker nodes to avoid clock skew.","Verify certificate notBefore dates with openssl x509 -noout -dates before importing.","Do not deploy certificates before their validity start date."],"tags":["ssl","certificate-validity","clock-skew","elasticsearch"],"backgroundTag":"jwt-token-expired","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}