{"record":{"id":"a00f451087cdf284","repo":"apache/seatunnel","slug":"keystore-certificate-is-not-yet-valid","errorCode":null,"errorMessage":"KeyStore certificate is not yet valid: ","messagePattern":"KeyStore certificate is not yet valid: ","errorType":"exception","errorClass":"CertificateNotYetValidException","httpStatus":null,"severity":"critical","filePath":"seatunnel-connectors-v2/connector-easysearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/easysearch/util/SSLUtils.java","lineNumber":160,"sourceCode":"    }\n\n    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {\n                ((X509Certificate) certificate).checkValidity();\n            } catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\n                        \"KeyStore certificate is expired: \" + e.getMessage());\n            } catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\n                        \"KeyStore certificate is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n}\n","sourceCodeStart":142,"sourceCodeEnd":166,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-easysearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/easysearch/util/SSLUtils.java#L142-L166","documentation":"Same validation path as 928: SSLUtils.validateCertificates catches CertificateNotYetValidException from X509Certificate.checkValidity() and rethrows 'KeyStore certificate is not yet valid: <detail>'. The certificate's notBefore date is in the future relative to the machine clock, so the JDK refuses to use it.","triggerScenarios":"createSSLContext -> validateCertificates encounters an X509 certificate whose validity has not started (now < notBefore).","commonSituations":"Severely skewed system clock (VM resumed, NTP not synced, wrong timezone/BIOS clock); newly issued certs distributed before their notBefore; generating certs on a machine with a future clock and deploying to one with a correct clock.","solutions":["Sync system time (chrony/ntpdate) on the SeaTunnel node and re-run the job.","Check the cert's notBefore with keytool -list -v and use a cert valid at current time.","Re-issue the certificate if it was generated on a machine with a wrong (future) clock.","Investigate repeated clock drift on VMs/containers and add time-sync monitoring."],"exampleFix":"// before: node clock 2023-01-01, cert notBefore 2024-06-01\nsudo ntpdate pool.ntp.org\n// after: clock synced, checkValidity passes","handlingStrategy":"validation","validationCode":"// Java/shell: verify clock and cert notBefore\ndate   # confirm system time is current\nkeytool -list -v -keystore es.jks | grep -i before","typeGuard":null,"tryCatchPattern":"try { sslContext = SSLUtils.createSSLContext(ks); } catch (CertificateNotYetValidException e) { log.error(\"Cert not yet valid (clock skew or bad cert): {} — sync NTP and re-issue\", e.getMessage()); throw e; }","preventionTips":["Run NTP/chrony on all SeaTunnel and ES nodes","Check notBefore when distributing newly issued certificates","Generate certificates on machines with correct clocks"],"tags":["easysearch","ssl","certificate"],"backgroundTag":"tls-certificate-not-yet-valid","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}