prestodb/presto · error · CertificateExpiredException

KeyStore certificate '%s' is expired:

Error message

KeyStore certificate '%s' is expired: 

What it means

validateCertificates walks every entry of a loaded KeyStore and calls X509Certificate.checkValidity(). When a certificate's notAfter date is in the past, CertificateExpiredException is rethrown with the alias name so the operator knows exactly which certificate expired. This is thrown during loadKeyStore, i.e. before any TLS handshake, so it fails fast at client/plugin startup.

Source

Thrown at presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java:281

    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException
    {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }

            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {
                ((X509Certificate) certificate).checkValidity();
                log.debug("Certificate '{}' is valid", alias);
            }
            catch (CertificateExpiredException e) {
                throw new CertificateExpiredException("KeyStore certificate '" + alias + "' is expired: " + e.getMessage());
            }
            catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException("KeyStore certificate '" + alias + "' is not yet valid: " + e.getMessage());
            }
        }
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Renew the expired certificate and import it: keytool -importcert -alias <alias> -file newcert.pem -keystore keystore.jks
2. Identify the expired alias from the message, then check it: keytool -list -v -keystore keystore.jks | grep -A2 'Until'
3. Rotate via your CA/issuer (certbot, internal CA) and redeploy the updated keystore
4. Fix host clock skew with NTP if the system time is wrong

Example fix

// before
keytool -genkeypair -alias mycert -validity 30 ...
// after
keytool -genkeypair -alias mycert -validity 365 ...  // and set up rotation/renewal

java
CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate cert = (X509Certificate) cf.generateCertificate(Files.newInputStream(certPath));
cert.checkValidity(); // throws before deploy if expired
System.out.println("Valid until: " + cert.getNotAfter());

java
static boolean isExpired(X509Certificate c) {
    return c.getNotAfter().before(new Date());
}

java
try {
    sslContext = provider.createSSLContext(config);
} catch (CertificateExpiredException e) {
    log.error("Rotate the keystore now; expired cert: " + e.getMessage());
    throw e;
}

When it happens

Trigger: loadKeyStore -> validateCertificates encounters an X509Certificate whose validity period has ended — typically a keystystore used for client certs whose end-entity certificate passed its notAfter date.

Common situations: Long-lived deployments where the 1-year certificate was never rotated, air-gapped systems that missed renewal, test keystores generated with short validity, or clocks skewed far into the future (or past cert expiry after VM snapshot restore).

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• KeyStore certificate is expired:
• KeyStore certificate is expired: ${e.getMessage()}
• Failed to verify truststore contents
• Error setting up SSL:
• KeyStore certificate is expired:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/deca733c92e0ca59. Report an issue: GitHub.