prestodb/presto · error · CertificateNotYetValidException

KeyStore certificate is not yet valid:

Error message

KeyStore certificate is not yet valid: 

What it means

In the same validateCertificates loop, checkValidity() throwing CertificateNotYetValidException means a certificate's notBefore date is in the future; the code rethrows with the prefix 'KeyStore certificate is not yet valid: '. The keystore contains a certificate that is not yet usable at the current system time.

Source

Thrown at presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java:268

            throws GeneralSecurityException
    {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }
            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {
                ((X509Certificate) certificate).checkValidity();
            }
            catch (CertificateExpiredException e) {
                throw new CertificateExpiredException("KeyStore certificate is expired: " + e.getMessage());
            }
            catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException("KeyStore certificate is not yet valid: " + e.getMessage());
            }
        }
    }

    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword, String trustStoreType)
            throws IOException, GeneralSecurityException
    {
        KeyStore trustStore = KeyStore.getInstance(trustStoreType);
        try {
            // attempt to read the trust store as a PEM file
            List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);
            if (!certificateChain.isEmpty()) {
                trustStore.load(null, null);
                for (X509Certificate certificate : certificateChain) {
                    X500Principal principal = certificate.getSubjectX500Principal();
                    trustStore.setCertificateEntry(principal.getName(), certificate);
                }
                return trustStore;

View on GitHub (pinned to 55bb57d202)

Solutions

1. Sync the system clock (enable NTP: chrony/ntpd, timedatectl set-ntp true).
2. Check the certificate's notBefore date with keytool -list -v.
3. Re-import the certificate after its validity window starts, or obtain one valid now.
4. Fix VM/host clock drift after snapshot restores.

Example fix

// before
$ date  # shows 2020-01-01, real date 2026-09-03
// after
$ timedatectl set-ntp true && chronyc makestep

X509Certificate cert = (X509Certificate) keyStore.getCertificate(alias);
if (cert.getNotBefore().after(new Date())) {
    throw new IllegalStateException("Certificate not valid until " + cert.getNotBefore());
}

try { buildClient(...); } catch (ClientException e) { if (e.getCause() instanceof CertificateNotYetValidException) { /* sync clock or fix cert */ } throw e; }

When it happens

Trigger: setupSsl -> validateCertificates encounters an X509Certificate whose notBefore date is after the client machine's current clock time.

Common situations: Client machine clock skew (wrong date/timezone, VM restored from snapshot); a newly issued certificate imported before its validity start; NTP not running.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• KeyStore certificate is not yet valid:
• KeyStore certificate is not yet valid: ${e.getMessage()}
• KeyStore certificate '%s' is not yet valid:
• ARROW_FLIGHT_INVALID_CERT_ERROR
• Error setting up SSL:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/0c09d4e2911aedd0. Report an issue: GitHub.