Docker pull error : x509: certificate has expired or is not yet valid

Question

Description of problem:

I'm trying to pull ubuntu from the public registry with this command :

docker pull ubuntu

And then i got this results (the previous command was working yesterday) :

"Error while pulling image: Get https://index.docker.io/v1/repositories/library/ubuntu/images: x509: certificate has expired or is not yet valid"

docker version :

Client:
Version: 1.10.0
API version: 1.22
Go version: go1.5.3
Git commit: 590d510
Built: Thu Feb 4 18:36:33 2016
OS/Arch: linux/amd64

Server:
Version: 1.10.0
API version: 1.22
Go version: go1.5.3
Git commit: 590d510
Built: Thu Feb 4 18:36:33 2016
OS/Arch: linux/amd64

docker info :

Containers: 4
Running: 0
Paused: 0
Stopped: 4
Images: 20
Server Version: 1.10.0
Storage Driver: aufs
Root Dir: /var/lib/docker/aufs
Backing Filesystem: extfs
Dirs: 44
Dirperm1 Supported: true
Execution Driver: native-0.2
Logging Driver: json-file
Plugins: 
Volume: local
Network: bridge null host
Kernel Version: 3.19.0-49-generic
Operating System: Ubuntu 14.04.3 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 5.815 GiB
Name: ubuntu
ID: Y6OO:23T2:BAPU:DVQJ:HJCJ:USEP:T6EU:PMG4:O4M6:46C7:JKPC:BQHT
WARNING: No swap limit support

uname -a :

Linux ubuntu 3.19.0-49-generic #55~14.04.1-Ubuntu SMP Fri Jan 22 11:24:31 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

I verify my "date" and everything is good. I don't know where this issue can come from.

For those who are facing problem with private repos, this can help: https://stackoverflow.com/a/65184268/1938507 — Junaed, Dec 07 '20 at 15:12

score 25 · Answer 1 · answered Oct 02 '18 at 10:10

25

this one did it for me docker-machine regenerate-certs --client-certs

answered Oct 02 '18 at 10:10

Dan Ochiana

2,827
1
26
25

the issue surfaced out of nowhere. Thanks for the tip ! – Cooshal May 22 '19 at 07:43
Thanks! This really helped. No idea why it isn't documented anywhere or some proper warning doesn't explain what the issue is exactly. – Artem Novikov Nov 11 '20 at 15:07
Thanks a lot! I recently restore my mac with time machine and it looks like docker cert no longer works. I can finally fix it with this after hours of frustration. – darkash Nov 19 '20 at 06:42
2

`docker-machine` is no longer available. – user246392 Mar 16 '21 at 16:30

score 22 · Answer 2 · answered Dec 12 '19 at 12:54

This can also apparently happen with time drift, which is a problem with Docker Desktop for Windows. The clock on the Linux VM that s running the Docker daemon does not, by default, sync time with your main Windows host. If, like me, you work on a laptop, and your laptop is asleep for long periods of time without you rebooting or otherwise restarting Docker, it would seem your Linux VM's clock can drift enough that you can get this error. Restarting Docker clears it up, however.

I recognize the OP is probably no longer in need of an answer and it was not necessarily the OPs issue (no indication if they were using Windows), but since I got here through my own research into this problem, I figured I'd add the answer.

Thanks, had this issue because machine was asleep over the 30th March British Summer Time clocks change while Docker VM was running. Restarting Docker resolved the issue. — danialk, Mar 30 '20 at 13:13
In my case, a restart of Docker Desktop was not enough (I use the Docker Desktop WSL 2 backend); after a reboot of the machine, the issue was gone. — Matze, Jan 26 '21 at 15:14

score 10 · Answer 3 · answered Aug 28 '18 at 09:52

I got this error, it was related to system date/time settings. (I realize the OP stated his date was OK, just adding this comment for other people who might arrive at this page where this is the issue - like I did!!)

Had an issue when I booted up my machine and the time/date settings were incorrect. Later, after my machine had the correct date/time settings, I tried to pull an image from docker and got the above error.

I restarted the docker daemon running locally, so it picked up the new date/time and can now pull successfully again.

Tyagi Akhilesh · Answer 4 · 2018-08-17T09:22:15.213

6

You can either use --insecure-registry option while starting docker deamon or need to provide valid certificate path. Look here for details.

edited Aug 17 '18 at 09:22

answered Feb 09 '16 at 19:09

Tyagi Akhilesh

606
6
12

2

The link is dead. – Doradus Mar 25 '18 at 12:05
Thanks. Corrected link. – Tyagi Akhilesh Aug 17 '18 at 09:22

score 5 · Answer 5 · answered Jan 09 '18 at 16:30

5

In my case I have decided to change the date and time of the server to the current date.

answered Jan 09 '18 at 16:30

Israel Zebulon

214
2
8

2

probably one of the worst solutions one could suggest :( – agilob Sep 25 '19 at 10:09
@agilob changing the server to something other than the current date would be bad. I'm reading this as a duplicate of the other answers, that Israel fixed the time/date on the server. If instead they changed the date to match the certificate, then I agree that's bad. – BMitch Aug 14 '20 at 19:55

score 4 · Answer 6 · answered Nov 03 '20 at 04:39

4

if this happened with Docker on Windows

Just Restart Docker Desktop

answered Nov 03 '20 at 04:39

Yasser

582
5
16

Like seriously the IT Crowd solution worked... :I Thanks. – Vedran Mandić Jan 28 '21 at 10:59
Also worked on Mac :) – Thomas Apr 30 '21 at 20:40

score 3 · Answer 7 · answered Jan 27 '20 at 14:21

3

This happened also to me:

while trying to login to an Artifactory.
when my local docker daemon has been running for a couple weeks.

I simply restarted my local docker daemon, and could login to the Artifactory with no error message.

answered Jan 27 '20 at 14:21

benjamin hautefeuille

31
2

score 0 · Answer 8 · answered Dec 16 '19 at 14:37

0

Check if your docker registry is running or not. if no registry is runnign try docker run -d -p 5000:5000 --name registry registry:2

answered Dec 16 '19 at 14:37

Goutam Dey

1

score 0 · Answer 9 · answered Jan 09 '20 at 14:37

0

If the other recommendations don't get you anywhere, make sure that you aren't using a reverse proxy (like Apache) AND Jetty.

If you are using both, its quite likely there is a *.jks that has not been updated with the most up to date certificate.

answered Jan 09 '20 at 14:37

ukrobo

81
1
2

score 0 · Answer 10 · answered Aug 14 '20 at 19:38

I had the similar issue on centos vagrant vm machine. When I were pulling any docker image, the bellow error were poping up

   error pulling image configuration: Get https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/4b/4bb46517cac397bdb0bab6eba09b0e1f8e90ddd17cf99662997c3253531136f8/data?verify=1597376104-j8KSa2vKDeIZNFuPq0EP9cb3sqc%3D: x509: certificate has expired or is not yet valid

The problem was the centos vagrant vm machine date and timezone were different from my host machine. After updating my vm machine to the same date and timezone with my host, the issue were fixed.

   #check the timezone
   $timedatectl
   #update timezone
   $timedatectl set-timezone America/Toronto
   #update date
   date --set="Fri August 14 3:08:10 EDT 2020"

score -1 · Answer 11 · answered Jan 13 '20 at 15:26

Whenever you face below problem please set your date and time correct:

"Error while pulling image: Get https://index.docker.io/v1/repositories/library/ubuntu/images: x509: certificate has expired or is not yet valid"

use below command for linux system to set the date and time

sudo date --set='Mon Jan 13 14:50:44 IST 2020' "Note"=> if you are from different time zone please set as CST,EST,EDT etc.

score -1 · Answer 12 · answered Oct 30 '20 at 17:50

In a dev environment you could avoid this error modify the file daemon.json alocate at /etc/docker/daemon.json add a insecure registry at the list and restart the docker engine

{
  "insecure-registries" : [ "myinsecureregistry.com:443", "myinsecureregistry.com", "x.x.x.x:5000" ]
}

Ref: daemon configuration

score -4 · Answer 13 · answered Mar 03 '17 at 09:00

-4

You need to check with network configuration.If you assign single network interface you will get this issue.In network setting check NIC's are enable both public and private.

answered Mar 03 '17 at 09:00

sowmya P

1
1

this answer makes no sense and lacks explanation. – jitter May 26 '19 at 20:09

Docker pull error : x509: certificate has expired or is not yet valid

13 Answers13

Linked