# ES Nodes with different dates **URL:** \ **Category:** Search Guard\ **Created:** [March 5, 2019, 7:20am UTC](https://forum.search-guard.com/t/es-nodes-with-different-dates/1354 "2019-03-05T07:20:03Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Kasinaat\_Selvi\_Sukesh](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/kasinaat_selvi_sukesh/32/500_2.png) [@Kasinaat\_Selvi\_Sukesh](https://forum.search-guard.com/u/Kasinaat_Selvi_Sukesh)\ **Post date:** [March 5, 2019, 7:20am UTC](https://forum.search-guard.com/t/es-nodes-with-different-dates/1354/1 "2019-03-05T07:20:03Z")
Search Guard and Elasticsearch version - 6.5.4 JVM version and operating system version - jre 1.8\_55 I am having an ES + Search-Guard Multiple Node Setup. While adding a new Node I am getting the following Exception Caused by: java.security.cert.CertificateNotYetValidException: NotBefore: Sat Mar 02 06:43:03 IST 2019 ``` at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:270) ~[?:?] at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:629) ~[?:?] at sun.security.provider.certpath.BasicChecker.verifyTimestamp(BasicChecker.java:190) ~[?:?] at sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:144) ~[?:?] at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:119) ~[?:?] at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:219) ~[?:?] at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140) ~[?:?] at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79) ~[?:?] at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292) ~[?:1.8.0_51] ``` `` My Master node is ahead of the data node in time.What should I do about this? I am generating the root certificate and the node certificates in the master node. Should I generate the node certificate in the specific node? ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 5, 2019, 5:29pm UTC](https://forum.search-guard.com/t/es-nodes-with-different-dates/1354/2 "2019-03-05T17:29:21Z")
You need to make sure that all your nodes are time synced (via ntp [https://en.wikipedia.org/wiki/Network\_Time\_Protocol\](https://en.wikipedia.org/wiki/Network_Time_Protocol%5C)). If not then in a distributed system like elasticsearch a lot of thing can go probably wrong. > **···** > > > Am 04.03.2019 um 23:20 schrieb Kasinaat Selvi Sukesh \: > > > > Search Guard and Elasticsearch version - 6.5.4 > > JVM version and operating system version - jre 1.8\_55 > > > > I am having an ES + Search-Guard Multiple Node Setup. > > > > While adding a new Node I am getting the following Exception > > > > Caused by: java.security.cert.CertificateNotYetValidException: NotBefore: Sat Mar 02 06:43:03 IST 2019 > >   at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:270) ~[?:?] > >   at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:629) ~[?:?] > >   at sun.security.provider.certpath.BasicChecker.verifyTimestamp(BasicChecker.java:190) ~[?:?] > >   at sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:144) ~[?:?] > >   at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:119) ~[?:?] > >   at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:219) ~[?:?] > >   at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140) ~[?:?] > >   at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79) ~[?:?] > >   at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292) ~[?:1.8.0\_51] > > > > My Master node is ahead of the data node in time.What should I do about this? > > > > I am generating the root certificate and the node certificates in the master node. > > Should I generate the node certificate in the specific node? > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/13d0e702-1023-4494-a9dc-d02610db8863%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/13d0e702-1023-4494-a9dc-d02610db8863%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Kasinaat\_Selvi\_Sukesh](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/kasinaat_selvi_sukesh/32/500_2.png) [@Kasinaat\_Selvi\_Sukesh](https://forum.search-guard.com/u/Kasinaat_Selvi_Sukesh)\ **Post date:** [March 6, 2019, 12:52pm UTC](https://forum.search-guard.com/t/es-nodes-with-different-dates/1354/3 "2019-03-06T12:52:50Z")
Can you please tell me what are the things that could go wrong? I was using elasticsearch without search guard for past 4 months. I didn’t encounter any issues. Can you please point me out some issues > **···** > > On Tuesday, March 5, 2019 at 12:50:03 PM UTC+5:30, Kasinaat Selvi Sukesh wrote: > > > > > > Search Guard and Elasticsearch version - 6.5.4 > > > JVM version and operating system version - jre 1.8\_55 > > > > > > I am having an ES + Search-Guard Multiple Node Setup. > > > > > > While adding a new Node I am getting the following Exception > > > > > > Caused by: java.security.cert.CertificateNotYetValidException: NotBefore: Sat Mar 02 06:43:03 IST 2019 > > > at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:270) ~[?:?] > > > at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:629) ~[?:?] > > > at sun.security.provider.certpath.BasicChecker.verifyTimestamp(BasicChecker.java:190) ~[?:?] > > > at sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:144) ~[?:?] > > > at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:119) ~[?:?] > > > at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:219) ~[?:?] > > > at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140) ~[?:?] > > > at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79) ~[?:?] > > > at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292) ~[?:1.8.0\_51] > > > `` > > > > > > My Master node is ahead of the data node in time.What should I do about this? > > > > > > I am generating the root certificate and the node certificates in the master node. > > > Should I generate the node certificate in the specific node? > > > > > >