prestodb/presto · error · CertificateNotYetValidException

KeyStore certificate '%s' is not yet valid:

Error message

KeyStore certificate '%s' is not yet valid: 

What it means

The counterpart of the expiry check: validateCertificates calls X509Certificate.checkValidity(), and if the certificate's notBefore date is in the future, CertificateNotYetValidException is rethrown with the offending alias. The keystore is rejected at load time because TLS peers would reject certs that are not yet valid.

Source

Thrown at presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java:284

        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }

            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {
                ((X509Certificate) certificate).checkValidity();
                log.debug("Certificate '{}' is valid", alias);
            }
            catch (CertificateExpiredException e) {
                throw new CertificateExpiredException("KeyStore certificate '" + alias + "' is expired: " + e.getMessage());
            }
            catch (CertificateNotYetValidException e) {
                throw new CertificateNotYetValidException("KeyStore certificate '" + alias + "' is not yet valid: " + e.getMessage());
            }
        }
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Sync system time (chronyd/ntpd, enable NTP in the container host) and restart the connector
2. Wait until the certificate's notBefore date if the rotation was deployed early
3. Reissue the certificate with a correct validity window from your CA
4. Verify with: keytool -list -v -keystore keystore.jks and check the 'Valid from' line for the named alias

Example fix

// before
# deploy new cert immediately after issuance
// after
# verify notBefore has passed before deploying:
# openssl x509 -in cert.pem -noout -dates

java
X509Certificate cert = ...;
Date now = new Date();
if (cert.getNotBefore().after(now)) {
    throw new IllegalStateException("Cert not valid until " + cert.getNotBefore());
}

java
static boolean notYetValid(X509Certificate c) {
    return c.getNotBefore().after(new Date());
}

java
try {
    sslContext = provider.createSSLContext(config);
} catch (CertificateNotYetValidException e) {
    log.error("Certificate not yet valid (check clocks / early deploy): " + e.getMessage());
    throw e;
}

When it happens

Trigger: loadKeyStore -> validateCertificates encounters an X509Certificate whose notBefore date is later than the current system time — e.g. a cert issued with a future start date or a badly skewed local clock.

Common situations: Clock skew (VM resumed from snapshot, RTC battery failure, wrong timezone/UTC mismatch), a certificate issued ahead of schedule during rotation and deployed too early, or certificates generated with wrong validity windows by automation.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• KeyStore certificate is not yet valid: ${e.getMessage()}
• KeyStore certificate is expired:
• KeyStore certificate is not yet valid:
• KeyStore certificate is not yet valid:
• HIVE_METASTORE_INITIALIZE_SSL_ERROR

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/362ea4424b6ee5c8. Report an issue: GitHub.