prestodb/presto · critical · CertificateExpiredException

KeyStore certificate is expired:

Error message

KeyStore certificate is expired: 

What it means

validateCertificates walks the entries of the configured truststore and calls X509Certificate.checkValidity() on each. If a certificate's notAfter date has passed, it throws CertificateExpiredException wrapping the original message. The connector refuses to build an SSL context with expired trust material, even if other certificates in the store are still valid.

Source

Thrown at presto-elasticsearch/src/main/java/com/facebook/presto/elasticsearch/client/ElasticsearchClient.java:390

        return trustStore;
    }

    private static void validateCertificates(KeyStore keyStore)
            throws GeneralSecurityException
    {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }
            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }
            try {
                ((X509Certificate) certificate).checkValidity();
            }
            catch (CertificateExpiredException e) {
                throw new CertificateExpiredException("KeyStore certificate is expired: " + e.getMessage());
            }
            catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException("KeyStore certificate is not yet valid: " + e.getMessage());
            }
        }
    }

    private Set<ElasticsearchNode> fetchNodes()
    {
        NodesResponse nodesResponse = doRequest("/_nodes/http", NODES_RESPONSE_CODEC::fromJson);

        ImmutableSet.Builder<ElasticsearchNode> result = ImmutableSet.builder();
        for (Map.Entry<String, NodesResponse.Node> entry : nodesResponse.getNodes().entrySet()) {
            String nodeId = entry.getKey();
            NodesResponse.Node node = entry.getValue();

            if (node.getRoles().contains("data")) {
                Optional<String> address = node.getAddress()

View on GitHub (pinned to 55bb57d202)

Solutions

1. Renew the Elasticsearch server/CA certificate and rebuild the truststore with the new CA.
2. Identify the expired entry with keytool -list -v and delete it if it is no longer needed.
3. Set up certificate rotation/monitoring before expiry.
4. If a clock issue, fix the host NTP/time settings.

Example fix

// before: truststore contains ca.crt expired 2025-01-01
// after: import renewed CA
keytool -delete -alias es-ca -keystore truststore.jks
keytool -importcert -alias es-ca -file new-ca.crt -keystore truststore.jks

// check expiry before deployment
keytool -list -v -keystore truststore.jks | grep -A2 'Valid from'
# or programmatically:
// X509Certificate c = ...; c.checkValidity(); // throws if expired

try {
    client = new ElasticsearchClient(...);
} catch (CertificateExpiredException e) {
    alert("ES truststore certificate expired: " + e.getMessage());
    throw e; // do not silently continue with expired trust
}

When it happens

Trigger: The truststore (or keystore) supplied via elasticsearch.security.truststore/keystore contains a certificate whose validity window has ended; this runs once at client/SSL context construction (buildSslContext).

Common situations: Long-lived clusters where the intermediate/root CA expired; certificates provisioned a year+ ago and never rotated; clocks wrong on the Presto coordinator (though usually it is truly expired).

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Unexpected default trust managers:
• KeyStore certificate is expired: ${e.getMessage()}
• Error setting up SSL:
• KeyStore certificate is expired:
• KeyStore certificate is not yet valid:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/857b49a8e87172c1. Report an issue: GitHub.