{"record":{"id":"deca733c92e0ca59","repo":"prestodb/presto","slug":"keystore-certificate-s-is-expired","errorCode":null,"errorMessage":"KeyStore certificate '%s' is expired: ","messagePattern":"KeyStore certificate '(.+?)' is expired: ","errorType":"exception","errorClass":"CertificateExpiredException","httpStatus":null,"severity":"error","filePath":"presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java","lineNumber":281,"sourceCode":"\n    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException\n    {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {\n                ((X509Certificate) certificate).checkValidity();\n                log.debug(\"Certificate '{}' is valid\", alias);\n            }\n            catch (CertificateExpiredException e) {\n                throw new CertificateExpiredException(\"KeyStore certificate '\" + alias + \"' is expired: \" + e.getMessage());\n            }\n            catch (CertificateNotYetValidException e) {\n                throw new CertificateNotYetValidException(\"KeyStore certificate '\" + alias + \"' is not yet valid: \" + e.getMessage());\n            }\n        }\n    }\n}\n","sourceCodeStart":263,"sourceCodeEnd":289,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java#L263-L289","documentation":"validateCertificates walks every entry of a loaded KeyStore and calls X509Certificate.checkValidity(). When a certificate's notAfter date is in the past, CertificateExpiredException is rethrown with the alias name so the operator knows exactly which certificate expired. This is thrown during loadKeyStore, i.e. before any TLS handshake, so it fails fast at client/plugin startup.","triggerScenarios":"loadKeyStore -> validateCertificates encounters an X509Certificate whose validity period has ended — typically a keystystore used for client certs whose end-entity certificate passed its notAfter date.","commonSituations":"Long-lived deployments where the 1-year certificate was never rotated, air-gapped systems that missed renewal, test keystores generated with short validity, or clocks skewed far into the future (or past cert expiry after VM snapshot restore).","solutions":["Renew the expired certificate and import it: keytool -importcert -alias <alias> -file newcert.pem -keystore keystore.jks","Identify the expired alias from the message, then check it: keytool -list -v -keystore keystore.jks | grep -A2 'Until'","Rotate via your CA/issuer (certbot, internal CA) and redeploy the updated keystore","Fix host clock skew with NTP if the system time is wrong"],"exampleFix":"// before\nkeytool -genkeypair -alias mycert -validity 30 ...\n// after\nkeytool -genkeypair -alias mycert -validity 365 ...  // and set up rotation/renewal","handlingStrategy":"validation","validationCode":"java\nCertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\nX509Certificate cert = (X509Certificate) cf.generateCertificate(Files.newInputStream(certPath));\ncert.checkValidity(); // throws before deploy if expired\nSystem.out.println(\"Valid until: \" + cert.getNotAfter());","typeGuard":"java\nstatic boolean isExpired(X509Certificate c) {\n    return c.getNotAfter().before(new Date());\n}","tryCatchPattern":"java\ntry {\n    sslContext = provider.createSSLContext(config);\n} catch (CertificateExpiredException e) {\n    log.error(\"Rotate the keystore now; expired cert: \" + e.getMessage());\n    throw e;\n}","preventionTips":["Monitor certificate expiry with alerts at 30/14/7 days before notAfter","Automate renewal (certbot, internal CA API) and keystore rebuild","Keep NTP enabled on all hosts","Add a CI check that validates all bundled keystores' validity windows"],"tags":["ssl","certificate-expired","keystore","security"],"backgroundTag":"certificate-expired","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}