Docker pull error : x509: certificate has expired or is not yet valid

Question

Description of problem:

I'm trying to pull ubuntu from the public registry with this command :

docker pull ubuntu

And then i got this results (the previous command was working yesterday) :

"Error while pulling image: Get https://index.docker.io/v1/repositories/library/ubuntu/images: x509: certificate has expired or is not yet valid"

docker version :

Client:
Version: 1.10.0
API version: 1.22
Go version: go1.5.3
Git commit: 590d510
Built: Thu Feb 4 18:36:33 2016
OS/Arch: linux/amd64

Server:
Version: 1.10.0
API version: 1.22
Go version: go1.5.3
Git commit: 590d510
Built: Thu Feb 4 18:36:33 2016
OS/Arch: linux/amd64

docker info :

Containers: 4
Running: 0
Paused: 0
Stopped: 4
Images: 20
Server Version: 1.10.0
Storage Driver: aufs
Root Dir: /var/lib/docker/aufs
Backing Filesystem: extfs
Dirs: 44
Dirperm1 Supported: true
Execution Driver: native-0.2
Logging Driver: json-file
Plugins: 
Volume: local
Network: bridge null host
Kernel Version: 3.19.0-49-generic
Operating System: Ubuntu 14.04.3 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 5.815 GiB
Name: ubuntu
ID: Y6OO:23T2:BAPU:DVQJ:HJCJ:USEP:T6EU:PMG4:O4M6:46C7:JKPC:BQHT
WARNING: No swap limit support

uname -a :

Linux ubuntu 3.19.0-49-generic #55~14.04.1-Ubuntu SMP Fri Jan 22 11:24:31 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

I verify my "date" and everything is good. I don't know where this issue can come from.

For those who are facing problem with private repos, this can help: https://stackoverflow.com/a/65184268/1938507 — Junaed, Dec 07 '20 at 15:12

score 40 · Answer 1 · answered Oct 02 '18 at 10:10

40

this one did it for me docker-machine regenerate-certs --client-certs

answered Oct 02 '18 at 10:10

Dan Ochiana

3,340
1
30
28

16

`docker-machine` is no longer available. – user246392 Mar 16 '21 at 16:30
you can install via: https://github.com/docker/machine/releases – aberkb Nov 28 '22 at 12:02

score 32 · Answer 2 · answered Dec 12 '19 at 12:54

32

This can also apparently happen with time drift, which is a problem with Docker Desktop for Windows. The clock on the Linux VM that s running the Docker daemon does not, by default, sync time with your main Windows host. If, like me, you work on a laptop, and your laptop is asleep for long periods of time without you rebooting or otherwise restarting Docker, it would seem your Linux VM's clock can drift enough that you can get this error. Restarting Docker clears it up, however.

I recognize the OP is probably no longer in need of an answer and it was not necessarily the OPs issue (no indication if they were using Windows), but since I got here through my own research into this problem, I figured I'd add the answer.

answered Dec 12 '19 at 12:54

Nathan Hartzell

321
3
2

Thanks, had this issue because machine was asleep over the 30th March British Summer Time clocks change while Docker VM was running. Restarting Docker resolved the issue. – danialk Mar 30 '20 at 13:13
2

In my case, a restart of Docker Desktop was not enough (I use the Docker Desktop WSL 2 backend); after a reboot of the machine, the issue was gone. – Matze Jan 26 '21 at 15:14
Quitting Docker-desktop and Starting again worked. Simply restarting Docker-desktop did not have the same effect for some reason. Thanks. – sunny_dev Jul 25 '21 at 08:04

score 11 · Answer 3 · answered Aug 28 '18 at 09:52

I got this error, it was related to system date/time settings. (I realize the OP stated his date was OK, just adding this comment for other people who might arrive at this page where this is the issue - like I did!!)

Had an issue when I booted up my machine and the time/date settings were incorrect. Later, after my machine had the correct date/time settings, I tried to pull an image from docker and got the above error.

I restarted the docker daemon running locally, so it picked up the new date/time and can now pull successfully again.

score 9 · Answer 4 · answered Nov 03 '20 at 04:39

9

if this happened with Docker on Windows

Just Restart Docker Desktop

answered Nov 03 '20 at 04:39

Yasser

1,159
1
14
19

1

Wanna add: I clicked "Restart Docker..." and that didn't work. However shutting it down completely and then starting it worked. – Younes El Ouarti Jun 25 '21 at 12:51

Tyagi Akhilesh · Answer 5 · 2018-08-17T09:22:15.213

8

You can either use --insecure-registry option while starting docker deamon or need to provide valid certificate path. Look here for details.

edited Aug 17 '18 at 09:22

answered Feb 09 '16 at 19:09

Tyagi Akhilesh

744
6
15

score 5 · Answer 6 · answered Jan 09 '18 at 16:30

5

In my case I have decided to change the date and time of the server to the current date.

answered Jan 09 '18 at 16:30

Israel Zebulon

262
3
12

score 2 · Answer 7 · answered Jan 27 '20 at 14:21

2

This happened also to me:

while trying to login to an Artifactory.
when my local docker daemon has been running for a couple weeks.

I simply restarted my local docker daemon, and could login to the Artifactory with no error message.

answered Jan 27 '20 at 14:21

benjamin hautefeuille

29
2

score 2 · Answer 8 · answered Aug 14 '20 at 19:38

I had the similar issue on centos vagrant vm machine. When I were pulling any docker image, the bellow error were poping up

   error pulling image configuration: Get https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/4b/4bb46517cac397bdb0bab6eba09b0e1f8e90ddd17cf99662997c3253531136f8/data?verify=1597376104-j8KSa2vKDeIZNFuPq0EP9cb3sqc%3D: x509: certificate has expired or is not yet valid

The problem was the centos vagrant vm machine date and timezone were different from my host machine. After updating my vm machine to the same date and timezone with my host, the issue were fixed.

   #check the timezone
   $timedatectl
   #update timezone
   $timedatectl set-timezone America/Toronto
   #update date
   date --set="Fri August 14 3:08:10 EDT 2020"

Unix timestamps are timezone-agnostic. More likely that changing the timezone also synced the clock to the correct time. — miken32, Jan 30 '23 at 23:57

score 1 · Answer 9 · answered Jun 13 '22 at 14:05

1

For anyone using Podman, a system reboot helped. Maybe restarting the podman machine could help as well.

answered Jun 13 '22 at 14:05

Alserda

4,246
1
17
25

score 0 · Answer 10 · answered Oct 30 '20 at 17:50

In a dev environment you could avoid this error modify the file daemon.json alocate at /etc/docker/daemon.json add a insecure registry at the list and restart the docker engine

{
  "insecure-registries" : [ "myinsecureregistry.com:443", "myinsecureregistry.com", "x.x.x.x:5000" ]
}

Ref: daemon configuration

Cem.S · Answer 11 · 2022-11-26T15:55:37.893

Had the same issue with my private docker registry on a QNAP server.

Apparently there is a bug with Container Station 3 as it does not renew the server certificates when you click on 'Renew' from Container station.

SSH into your NAS, clear all .pem files from /etc/docker/tls, then restart Container Station with

/share/CACHEDEV1_DATA/.qpkg/container-station/container-station.sh restart

Copy the newly generated ca.pem, cert.pem and key.pem files from etc/docker/tls to your ~/.docker folder and it should be working again.

score -1 · Answer 12 · edited Dec 27 '22 at 19:01

-1

Check if your docker registry is running or not. if no registry is runnign try docker run -d -p 5000:5000 --name registry registry:2

edited Dec 27 '22 at 19:01

Ray Baxter

3,181
23
27

answered Dec 16 '19 at 14:37

Goutam Dey

1

score -1 · Answer 13 · answered Jan 09 '20 at 14:37

-1

If the other recommendations don't get you anywhere, make sure that you aren't using a reverse proxy (like Apache) AND Jetty.

If you are using both, its quite likely there is a *.jks that has not been updated with the most up to date certificate.

answered Jan 09 '20 at 14:37

ukrobo

89
1
2

score -1 · Answer 14 · answered Jan 13 '20 at 15:26

Whenever you face below problem please set your date and time correct:

"Error while pulling image: Get https://index.docker.io/v1/repositories/library/ubuntu/images: x509: certificate has expired or is not yet valid"

use below command for linux system to set the date and time

sudo date --set='Mon Jan 13 14:50:44 IST 2020' "Note"=> if you are from different time zone please set as CST,EST,EDT etc.

score -1 · Answer 15 · answered Jul 13 '21 at 10:14

-1

On Windows, with WSL2 backend? You can open a new WSL2 command prompt and use:

sudo hwclock -s

answered Jul 13 '21 at 10:14

Kieren Johnstone

41,277
16
94
144

score -1 · Answer 16 · edited Oct 15 '21 at 06:32

I had a similar issue in Centos7.

Error:

-bash-4.2$ docker pull docker.elastic.co/elasticsearch/elasticsearch:7.10.1
Error response from daemon: Get https://docker.elastic.co/v2/: x509: certificate has expired or is not yet valid

Solution:

As suggested by others, checked the date of the system, it was ok. Docker pulled all the other repos - all were working as well.

The below steps resolved the issue:

Reset the list of trusted CA certificates by following the steps listed here.
Restart the docker using sudo systemctl docker restart.

Docker pull should be working as expected.

-bash-4.2$ docker pull docker.elastic.co/elasticsearch/elasticsearch:7.10.2
7.10.2: Pulling from elasticsearch/elasticsearch

score -1 · Answer 17 · answered Feb 06 '22 at 11:19

in my case i had to add

registry_nginx['ssl_certificate'] = "/path/to/certificate.pem"
registry_nginx['ssl_certificate_key'] = "/path/to/certificate.key"

to my /etc/gitlab/gitlab.rb , because I was using certbot for ssl certification of my gitlab.example.com domain. I used the same fullchain.pem and privkey.pem for my registry and the error gone.

score -1 · Answer 18 · answered Jun 14 '22 at 12:19

-1

If this happened with Docker on Windows: Try to restart Windows, it will help to fix timezone issues.

answered Jun 14 '22 at 12:19

MeBex

488
1
5
20

score -1 · Answer 19 · answered Jan 30 '23 at 23:54

-1

Try update your operating system. Sometimes some cert chains are also updated with. It have solved in my case.

answered Jan 30 '23 at 23:54

Luciano

159
1
3

score -4 · Answer 20 · answered Mar 03 '17 at 09:00

-4

You need to check with network configuration.If you assign single network interface you will get this issue.In network setting check NIC's are enable both public and private.

answered Mar 03 '17 at 09:00

sowmya P

1
1

1

this answer makes no sense and lacks explanation. – jitter May 26 '19 at 20:09

Docker pull error : x509: certificate has expired or is not yet valid

20 Answers20

Linked