prestodb/presto · critical · CertificateNotYetValidException

KeyStore certificate is not yet valid: ${e.getMessage()}

Error message

KeyStore certificate is not yet valid: ${e.getMessage()}

What it means

Thrown by HiveMetastoreClientFactory.validateKeyStoreCertificates when an X509 certificate's notBefore date is in the future, i.e. checkValidity() raises CertificateNotYetValidException. The factory refuses to build the SSL context with a certificate that is not yet valid, since the TLS peer would reject it anyway.

Source

Thrown at presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/HiveMetastoreClientFactory.java:223

            throws GeneralSecurityException
    {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }
            final Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {
                ((X509Certificate) certificate).checkValidity();
            }
            catch (CertificateExpiredException e) {
                throw new CertificateExpiredException("KeyStore certificate is expired: " + e.getMessage());
            }
            catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException("KeyStore certificate is not yet valid: " + e.getMessage());
            }
        }
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Sync the machine clock: enable and start ntpd/chronyd (chrony sources, timedatectl set-ntp true) and verify with `date -u` against a reliable time source
2. Confirm the certificate's notBefore date with `keytool -list -v -keystore keystore.jks`; if deployed early, redeploy on/after that date
3. If the certificate is simply misissued, request a reissued certificate with a correct validity window
4. Check for hypervisor/VM clock drift after suspend-resume and reset with hwclock -s

Example fix

// before
throw new CertificateNotYetValidException("KeyStore certificate is not yet valid: " + e.getMessage());
// after
# fix clock skew, then restart
# sudo systemctl enable --now chronyd
# verify: openssl x509 -in cert.pem -noout -dates

import java.io.*;
import java.security.*;
import java.security.cert.*;
import java.util.*;

public static void checkNotBeforeDates(String keystorePath, char[] password) throws GeneralSecurityException, IOException {
    KeyStore ks = KeyStore.getInstance("JKS");
    try (InputStream in = new FileInputStream(keystorePath)) {
        ks.load(in, password);
    }
    Date now = new Date();
    for (Enumeration<String> e = ks.aliases(); e.hasMoreElements(); ) {
        Certificate c = ks.getCertificate(e.nextElement());
        if (c instanceof X509Certificate) {
            ((X509Certificate) c).checkValidity(now); // throws CertificateNotYetValidException if notBefore > now
        }
    }
}

public static boolean isNotYetValid(X509Certificate cert) {
    try { cert.checkValidity(); return false; }
    catch (CertificateNotYetValidException e) { return true; }
    catch (CertificateExpiredException e) { return false; }
}

try {
    createHiveMetastoreClient(config);
} catch (CertificateNotYetValidException e) {
    log.error("Cert not yet valid — check system clock and cert notBefore date", e);
    throw new ConfigurationException("Synchronize NTP or deploy certificate on/after its notBefore date");
}

When it happens

Trigger: Creating the Hive metastore client with a keystore whose certificate validity has not started — typically caused by clock skew or a pre-issued certificate placed into use too early.

Common situations: Presto node system clock wrong (NTP not running, VM restored from snapshot); certificate issued for a future start date and deployed ahead of schedule; timezone/clock drift in containers without an ntp daemon.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• KeyStore certificate is not yet valid:
• HIVE_METASTORE_INITIALIZE_SSL_ERROR
• KeyStore certificate is expired: ${e.getMessage()}
• KeyStore certificate '%s' is not yet valid:
• KeyStore certificate is expired:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/34869d8b9a56b74e. Report an issue: GitHub.