{"record":{"id":"aebff109340676c4","repo":"apache/cassandra","slug":"certificate-for-expired-on","errorCode":null,"errorMessage":"Certificate for {} expired on {}","messagePattern":"Certificate for (.+?) expired on (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java","lineNumber":243,"sourceCode":"        {\n            throw new SSLException(\"failed to build key manager store for secure connections\", e);\n        }\n    }\n\n    protected boolean checkExpiredCerts(KeyStore ks) throws KeyStoreException\n    {\n        boolean hasExpiredCerts = false;\n        final Date now = new Date(Clock.Global.currentTimeMillis());\n        for (Enumeration<String> aliases = ks.aliases(); aliases.hasMoreElements(); )\n        {\n            String alias = aliases.nextElement();\n            if (ks.getCertificate(alias).getType().equals(\"X.509\"))\n            {\n                Date expires = ((X509Certificate) ks.getCertificate(alias)).getNotAfter();\n                if (expires.before(now))\n                {\n                    hasExpiredCerts = true;\n                    logger.warn(\"Certificate for {} expired on {}\", alias, expires);\n                }\n            }\n        }\n        return hasExpiredCerts;\n    }\n\n    /**\n     * Helper class for hot reloading SSL Contexts\n     */\n    protected static class HotReloadableFile\n    {\n        private final File file;\n        private volatile long lastModTime;\n\n        HotReloadableFile(String path)\n        {\n            file = new File(path);\n            lastModTime = file.lastModified();","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java#L225-L261","documentation":"During SSL context construction, checkExpiredCerts iterates key store aliases and warns when an X.509 certificate's notAfter date is in the past. It sets hasExpiredCerts, which (with strict expiration checking enabled) causes SSLFactory to throw SSLException. The keystore still works for non-strict setups, but expired certs cause TLS handshake failures with peers.","triggerScenarios":"getKeyManagerFactory() loads a keystore whose certificate for some alias has expires.before(now); logged per expired alias.","commonSituations":"Forgotten certificate renewal in long-lived clusters; TLS errors like 'certificate_expired' after a cert passes its notAfter date; CI nodes with stale test certs.","solutions":["Renew the certificate and replace it in the keystore referenced by server/client_encryption_options.","Verify expiry with: keytool -list -v -keystore <ks> | grep -A1 until.","Automate renewal (cert-manager/lets-encrypt) and monitor expiry dates.","As a temporary measure, strict_mode can be tuned, but renewal is the only real fix."],"exampleFix":"// before\nopenssl x509 -in old.crt -checkend 0  # expired\n// after: renew and rebuild keystore\nkeytool -importcert -alias node1 -file renewed.crt -keystore .keystore","handlingStrategy":"validation","validationCode":"// check cert expiry before building SSL context\nCertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\nX509Certificate cert = (X509Certificate) cf.generateCertificate(new FileInputStream(\"node.crt\"));\nif (cert.getNotAfter().before(new Date())) throw new IllegalStateException(\"Renew cert: expired \" + cert.getNotAfter());","typeGuard":null,"tryCatchPattern":"try {\n    sslContext = sslFactory.createSSLContext();\n} catch (SSLException | CertificateExpiredException e) {\n    throw new IllegalStateException(\"TLS certs expired - rotate keystore\", e);\n}","preventionTips":["Automate certificate renewal (cert-manager, ACME) well before notAfter.","Monitor all keystores with a cron job using keytool -list and alert at e.g. 30 days before expiry.","Use strict expiration checking in production so startup fails loudly instead of failing handshakes at runtime."],"tags":["tls","certificate-expired","ssl","keystore"],"backgroundTag":"certificate-expired","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}