prestodb/presto · critical · CertificateNotYetValidException

KeyStore certificate is not yet valid:

Error message

KeyStore certificate is not yet valid: 

What it means

validateCertificates calls X509Certificate.checkValidity() on each truststore entry; if the current date is before the certificate's notBefore date, it throws CertificateNotYetValidException. The SSL context cannot be built with certificates that are not yet valid. This mirrors the expired-certificate path but fires for future-dated certificates.

Source

Thrown at presto-elasticsearch/src/main/java/com/facebook/presto/elasticsearch/client/ElasticsearchClient.java:393

    private static void validateCertificates(KeyStore keyStore)
            throws GeneralSecurityException
    {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }
            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }
            try {
                ((X509Certificate) certificate).checkValidity();
            }
            catch (CertificateExpiredException e) {
                throw new CertificateExpiredException("KeyStore certificate is expired: " + e.getMessage());
            }
            catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException("KeyStore certificate is not yet valid: " + e.getMessage());
            }
        }
    }

    private Set<ElasticsearchNode> fetchNodes()
    {
        NodesResponse nodesResponse = doRequest("/_nodes/http", NODES_RESPONSE_CODEC::fromJson);

        ImmutableSet.Builder<ElasticsearchNode> result = ImmutableSet.builder();
        for (Map.Entry<String, NodesResponse.Node> entry : nodesResponse.getNodes().entrySet()) {
            String nodeId = entry.getKey();
            NodesResponse.Node node = entry.getValue();

            if (node.getRoles().contains("data")) {
                Optional<String> address = node.getAddress()
                        .flatMap(ElasticsearchClient::extractAddress);

                result.add(new ElasticsearchNode(nodeId, address));

View on GitHub (pinned to 55bb57d202)

Solutions

1. Fix the host clock / NTP sync if time skew is the cause.
2. Use the final (not pre-issued) certificate in the truststore.
3. Regenerate the certificate with a notBefore date at or before now.
4. Check the entry with keytool -list -v and replace future-dated certs.

Example fix

// before: cert notBefore=2027-01-01 (bad clock when generated)
// after: regenerate on a host with correct time, then
keytool -importcert -alias es-ca -file ca.crt -keystore truststore.jks

// verify validity window before use
keytool -list -v -keystore truststore.jks | grep -A1 'Valid from'
// ensure 'Valid from' start date <= current date

try {
    client = new ElasticsearchClient(...);
} catch (CertificateNotYetValidException e) {
    log.error("Cert not yet valid — check host clock or cert notBefore: " + e.getMessage());
    throw e;
}

When it happens

Trigger: A certificate in the configured truststore/keystore has a notBefore date later than the current system time; thrown during buildSslContext at client initialization.

Common situations: Certificates generated with wrong system clock (host clock set far in the past when cert was created); staged rollout of renewed certs loaded too early; time skew after VM snapshot restore.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• KeyStore certificate is not yet valid: ${e.getMessage()}
• KeyStore certificate is not yet valid:
• Unexpected default trust managers:
• KeyStore certificate is expired:
• KeyStore certificate '%s' is not yet valid:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/65b4bd89130e16c3. Report an issue: GitHub.