CertPathValidatorException: validity check failed

Where you see it

In any Java client that opens an HTTPS or other TLS connection, wrapped by frameworks such as Spring, Apache HttpClient, JDBC drivers and build tools. The root cause is at the bottom of the stack trace:

javax.net.ssl.SSLHandshakeException: (certificate_expired) PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed
	...
Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed
	...
Caused by: java.security.cert.CertPathValidatorException: validity check failed
	...
Caused by: java.security.cert.CertificateExpiredException: NotAfter: Wed Apr 01 02:00:00 CEST 2026

Java 23 and later, and recent updates of Java 17 and 21, add (certificate_expired) in front; older versions, including Java 8 and 11, start with PKIX path validation failed. The date after NotAfter: is printed in the JVM’s local time zone. A certificate that is not valid yet gives CertificateNotYetValidException: NotBefore: … instead. The strings come from OpenJDK’s BasicChecker.java and CertificateValidity.java.

What it means

Note the word validation. “PKIX path building failed” means Java found no path to a trusted root at all (that page). “Path validation failed” means Java did find a path, then one of its checks failed: here the check of the validity period. A certificate on the path, almost always the server’s own, is past its notAfter date by the JVM’s clock. Java will not use it, even though everything else is correct.

Likely causes

The server’s certificate expired

Confirm with keytool, which prints the certificates a server sends without needing to trust them:

keytool -printcert -sslserver api.example.com:443

Certificate #0
====================================
Owner: CN=api.example.com
Issuer: CN=Example Issuing CA, O=Example CA
Serial number: 1000
Valid from: Thu Jan 01 00:00:00 UTC 2026 until: Wed Apr 01 00:00:00 UTC 2026

Fix: renew the certificate, install it with its full chain, and reload the server. If it is not your server, tell its owner. Public TLS certificates may be valid for at most 200 days since 15 March 2026, and for at most 47 days from 15 March 2029, so automate renewal and monitor expiry: How to check when a certificate expires, and monitor it.

It was renewed, but a Java server still uses the old keystore

Tomcat, Jetty, Spring Boot and other Java servers read their keystore when the connector starts. A new certificate in the file does nothing until the connector reloads. Confirm what the keystore holds, and compare it with what keytool -printcert -sslserver shows:

keytool -list -v -keystore server.p12 -storepass changeit | grep -E 'Alias name|Valid from'

Fix: restart the server, or use its reload feature, and test again. Behind a load balancer, test each node. See How to install a certificate in Tomcat and other Java servers.

An intermediate in the chain expired

If Certificate #1 or higher in the keytool -printcert -sslserver output is out of date, the server sends an old intermediate. Rebuild the chain from the CA’s current intermediate and reload. See How to build the full chain file your server needs.

The JVM’s clock is wrong

If the dates look fine but one machine or container fails, check its time in UTC (date -u), and the time zone the JVM uses. Turn on time synchronisation (sudo timedatectl set-ntp true on systemd Linux, w32tm /resync on Windows). A clock that runs far enough behind gives CertificateNotYetValidException, with (bad_certificate) in front on versions that show the alert name.

A client certificate expired

In mutual TLS, a server also checks the client’s certificate. If a Java server’s log shows this exception during a client’s handshake, look at the client certificate’s dates and issue the client a new one.

Check yours

Try it: Certificate decoderOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste a certificate

Try a sampleChoose a sample…A website certificate (www.example.com)An expired certificateA wildcard certificate (*.example.com)A certificate with a Common Name but no SANA self-signed root CAA complete chain: leaf, intermediate and root

-----BEGIN CERTIFICATE----- MIIC1jCCAnygAwIBAgIQNPchftz8jn6EE0nYthv4IzAKBggqhkjOPQQDAjB+MQsw CQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UECxMe U2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSswKQYDVQQDEyJQS0kgWmVy byB0byBIZXJvIFNhbXBsZSBJc3N1aW5nIENBMB4XDTI1MTEwMTAwMDAwMFoXDTI2 MDEzMDAwMDAwMFowGjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMFkwEwYHKoZI zj0CAQYIKoZIzj0DAQcDQgAEnFxMTbSS6N//zfTxXpHxlwQXb/vUy+GJ0VD/hV2T qh4hwe8YIotO6LTc8gcoN7U/lzWAxB0YGCQNdl3ZkaeNC6OCAT4wggE6MAwGA1Ud EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMCcG A1UdEQQgMB6CD3d3dy5leGFtcGxlLmNvbYILZXhhbXBsZS5jb20wHQYDVR0OBBYE FLePvyuDFGAE/tNEqDYHGxSlxoD9MB8GA1UdIwQYMBaAFN+ph37v40SN23r6Fg/z OvSNjJqeMEgGCCsGAQUFBwEBBDwwOjA4BggrBgEFBQcwAoYsaHR0cDovL3BraS5l eGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcnQwPQYDVR0fBDYwNDAyoDCg LoYsaHR0cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcmww EwYDVR0gBAwwCjAIBgZngQwBAgEwCgYIKoZIzj0EAwIDSAAwRQIhAM8HGMZHERBn faVlrjwlVBfFzLIBiMhxHlwupcIdsXYfAiBjweZeZ9ch63PQ3YYp81rY4QHX1y9Q vdp9yJS+yypzgg== -----END CERTIFICATE-----

PEM text, several PEM blocks, or a .pem, .crt, .cer or .der file (drop it on the box). Certificates are public, so they are safe to paste.

DecodeClearChoose a file

Paste the server’s certificate (PEM, for example from openssl s_client -showcerts). The decoder shows notBefore, notAfter and how many days are left or overdue.

Learn why

• Anatomy of an X.509 certificate: the validity fields.
• Inventory, expiry and renewal: stopping expiry outages.
• Related: PKIX path building failed and verify error:num=10.

In the gameLevel 8: The certificateRoyal Notary, Keystone. In development