{"record":{"id":"c93837aa8dd78f91","repo":"apache/cassandra","slug":"certificate-with-identity-will-expire-in","errorCode":null,"errorMessage":"Certificate with identity '{}' will expire in {}","messagePattern":"Certificate with identity '(.+?)' will expire in (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java","lineNumber":240,"sourceCode":"                nospamLogger.error(msg);\n                throw new AuthenticationException(msg);\n            }\n            String role = identityCache.get(identity);\n            if (role == null)\n            {\n                String msg = \"Certificate identity '{}' not authorized\";\n                nospamLogger.error(msg, identity);\n                throw new AuthenticationException(MessageFormatter.format(msg, identity).getMessage());\n            }\n\n            // Validates that the certificate validity period does not exceed the maximum certificate configured validity period\n            int minutesToCertificateExpiration = certificateValidityPeriodValidator.validate(clientCertificateChain);\n            int daysToCertificateExpiration = MutualTlsUtil.minutesToDays(minutesToCertificateExpiration);\n\n            if (certificateValidityWarnThreshold != null\n                && minutesToCertificateExpiration < certificateValidityWarnThreshold.toMinutes())\n            {\n                nospamLogger.warn(\"Certificate with identity '{}' will expire in {}\",\n                                  identity, MutualTlsUtil.toHumanReadableCertificateExpiration(minutesToCertificateExpiration));\n            }\n\n            // Report metrics on client certificate expiration\n            MutualTlsMetrics.instance.clientCertificateExpirationDays.update(daysToCertificateExpiration);\n\n            return new AuthenticatedUser(role, MTLS, Map.of(METADATA_IDENTITY_KEY, identity));\n        }\n\n        @Override\n        public AuthenticationMode getAuthenticationMode()\n        {\n            return MTLS;\n        }\n    }\n\n    static class IdentityCache extends AuthCache<String, String>\n    {","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java#L222-L258","documentation":"MutualTlsAuthenticator.getAuthenticatedUser validates client certificate chain validity periods; when minutes-to-expiration falls below the configured certificate_validity_warn_threshold it logs a warning via a nospam logger that the certificate for the given identity will expire soon.","triggerScenarios":"A mTLS client authenticates with a certificate whose remaining validity (minutesToCertificateExpiration from certificateValidityPeriodValidator) is less than certificate_validity_warn_threshold in cassandra.yaml.","commonSituations":"Short-lived client certificates approaching expiry; certificates issued by an internal PKI with no automated rotation; clients using long-lived but nearly expired certs after a holiday freeze.","solutions":["Renew the client certificate identified in the message before it expires (re-issue from your CA and redistribute to the client).","Set up automated certificate rotation (cert-manager, Vault PKI) keyed to a threshold well inside the warn window.","Tune certificate_validity_warn_threshold in cassandra.yaml to give enough lead time for your rotation process.","Monitor the metrics (clientCertificateExpirationDays histogram) and alert on low remaining validity."],"exampleFix":"// before\ncertificate_validity_warn_threshold: 30d  # too late for manual rotation\n// after\ncertificate_validity_warn_threshold: 30d\n# plus automated rotation: cert-manager renewBefore: 45d","handlingStrategy":"validation","validationCode":"# check client cert remaining validity before connecting\nfrom cryptography import x509\nnot_after = x509.load_pem_x509_certificate(pem).not_valid_after\nremaining_days = (not_after - datetime.utcnow()).days\nassert remaining_days > 30, \"renew client certificate before it expires\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Automate client certificate rotation (cert-manager/Vault PKI).","Alert on the clientCertificateExpirationDays metric before the warn threshold trips.","Set certificate_validity_warn_threshold to comfortably exceed your rotation lead time."],"tags":["mtls","tls","certificate-expiry","auth"],"backgroundTag":"jwt-token-expired","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}