{"record":{"id":"a299fbf4f3f7087c","repo":"apache/seatunnel","slug":"keystore-certificate-is-expired","errorCode":null,"errorMessage":"KeyStore certificate is expired: ","messagePattern":"KeyStore certificate is expired: ","errorType":"exception","errorClass":"CertificateExpiredException","httpStatus":null,"severity":"critical","filePath":"seatunnel-connectors-v2/connector-easysearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/easysearch/util/SSLUtils.java","lineNumber":157,"sourceCode":"            trustStore.load(in, trustStorePassword.map(String::toCharArray).orElse(null));\n        }\n        return trustStore;\n    }\n\n    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {\n                ((X509Certificate) certificate).checkValidity();\n            } catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\n                        \"KeyStore certificate is expired: \" + e.getMessage());\n            } catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\n                        \"KeyStore certificate is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n}\n","sourceCodeStart":139,"sourceCodeEnd":166,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-easysearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/easysearch/util/SSLUtils.java#L139-L166","documentation":"SSLUtils.validateCertificates iterates the keystore entries and calls X509Certificate.checkValidity() against the current clock; a CertificateExpiredException is rethrown as 'KeyStore certificate is expired: <detail>'. The configured certificate chain used for the Easysearch TLS connection has passed its notAfter date.","triggerScenarios":"createSSLContext -> validateCertificates finds an X509 certificate in the keystore whose validity period has ended (now > notAfter).","commonSituations":"Self-signed or internally-issued certs not rotated on schedule; long-running clusters whose 1-year certs lapsed; importing a stale dev keystore into production config.","solutions":["Renew the certificate and import the new one into the keystore (keytool -importcert -file new.crt -keystore ...).","Verify expiry with keytool -list -v -keystore ... | grep until and rotate before it lapses.","Regenerate self-signed certs (keytool -genkeypair) with a longer validity if appropriate.","As a temporary dev-only workaround, disable verification per connector TLS options — never in production."],"exampleFix":"// before: expired cert in truststore\nkeytool -importcert -keystore es.jks -file old.crt\n// after\nkeytool -list -v -keystore es.jks   # confirm notAfter\nkeytool -importcert -keystore es.jks -file renewed.crt -alias es","handlingStrategy":"validation","validationCode":"// shell: check expiry before running the job\nkeytool -list -v -keystore es.jks | grep -A1 'Alias name' | grep until\n# or programmatically:\n// ((X509Certificate) ks.getCertificate(alias)).checkValidity();","typeGuard":null,"tryCatchPattern":"try { sslContext = SSLUtils.createSSLContext(ks); } catch (CertificateExpiredException e) { log.error(\"Keystore cert expired: {} — rotate the certificate\", e.getMessage()); throw e; }","preventionTips":["Track certificate notAfter dates and rotate before expiry","Run checkValidity() in a startup health check","Automate renewal for internal CA certs"],"tags":["easysearch","ssl","certificate-expired"],"backgroundTag":"tls-certificate-expired","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}