prestodb/presto · critical · CertificateExpiredException

KeyStore certificate is expired: ${e.getMessage()}

Error message

KeyStore certificate is expired: ${e.getMessage()}

What it means

Thrown by HiveMetastoreClientFactory.validateKeyStoreCertificates when an X509 certificate in the configured keystore fails checkValidity() because its notAfter date has passed. The factory validates every keystore certificate before building the SSL context for the Thrift metastore connection, so TLS cannot proceed with an expired credential.

Source

Thrown at presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/HiveMetastoreClientFactory.java:220

     * @throws GeneralSecurityException
     */
    private static void validateKeyStoreCertificates(KeyStore keyStore)
            throws GeneralSecurityException
    {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }
            final Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {
                ((X509Certificate) certificate).checkValidity();
            }
            catch (CertificateExpiredException e) {
                throw new CertificateExpiredException("KeyStore certificate is expired: " + e.getMessage());
            }
            catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException("KeyStore certificate is not yet valid: " + e.getMessage());
            }
        }
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Obtain a renewed certificate from your CA and import it into the keystore with keytool -importcert (or replace the keypair), then point hive.metastore.thrift.client.ssl.keystore-path at the updated file
2. Check expiry with: keytool -list -v -keystore keystore.jks and look for 'Valid until'; automate alerting on the notAfter date
3. If only a trust-chain entry expired, update the truststore with the renewed CA certificate instead of replacing the client identity
4. As a last resort for internal testing only, regenerate a self-signed certificate with a longer validity and update both keystore and truststore on client and metastore

Example fix

// before
throw new CertificateExpiredException("KeyStore certificate is expired: " + e.getMessage());
// after
# renew then reload
# keytool -genkeypair -alias presto-metastore -keyalg RSA -validity 730 -keystore keystore.jks
# config.properties: hive.metastore.thrift.client.ssl.keystore-path=/etc/presto/renewed-keystore.jks

import java.io.*;
import java.security.*;
import java.security.cert.*;
import java.util.*;

public static void validateKeystoreBeforeConnect(String path, char[] password) throws GeneralSecurityException, IOException {
    KeyStore ks = KeyStore.getInstance("JKS");
    try (InputStream in = new FileInputStream(path)) {
        ks.load(in, password);
    }
    Date now = new Date();
    for (Enumeration<String> e = ks.aliases(); e.hasMoreElements(); ) {
        Certificate c = ks.getCertificate(e.nextElement());
        if (c instanceof X509Certificate) {
            ((X509Certificate) c).checkValidity(now); // throws CertificateExpiredException early
        }
    }
}

public static boolean isExpired(X509Certificate cert) {
    try { cert.checkValidity(); return false; }
    catch (CertificateExpiredException e) { return true; }
    catch (CertificateNotYetValidException e) { return false; }
}

try {
    createHiveMetastoreClient(config);
} catch (CertificateExpiredException e) {
    log.error("Keystore cert expired; renew before proceeding", e);
    throw new ConfigurationException("Renew the keystore certificate: " + e.getMessage());
}

When it happens

Trigger: Calling HiveMetastoreClientFactory.create()/buildSslContext with hive.metastore.thrift.client.ssl.keystore-path pointing at a keystore containing a certificate whose validity period has ended.

Common situations: Keystore provisioned months ago and left untouched; CA-issued client cert with 1-year validity forgotten during renewal rotation; container images baked with certificates that expire while deployed; sandbox/CI environments with static test keystores.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• HIVE_METASTORE_INITIALIZE_SSL_ERROR
• KeyStore certificate is expired:
• KeyStore certificate is expired:
• Expected exactly one X509TrustManager, but found: ${trustMan
• KeyStore certificate is not yet valid: ${e.getMessage()}

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/81c1fb64c6a043b3. Report an issue: GitHub.