How to fix x509: certificate has expired or is not yet valid in Docker

# Check current system time and timezone
date
timedatectl

# Check if time is significantly different from actual time
# Compare with: https://time.is/

# If time is wrong, set it manually
sudo date --set="2025-01-15 14:30:00"

# Or sync with NTP server immediately
sudo ntpdate pool.ntp.org
# Or with systemd-timesyncd
sudo timedatectl set-ntp true

# VirtualBox - sync guest time with host
VBoxManage setextradata "VM Name" "VBoxInternal/Devices/VMMDev/0/Config/GetHostTimeDisabled" 0

# Inside the VM, install guest additions and restart
sudo apt-get install virtualbox-guest-utils
sudo systemctl restart vboxadd-service

sudo systemctl restart docker

# Enable and start time synchronization
sudo timedatectl set-ntp true

# Check synchronization status
timedatectl status

# View sync details
timedatectl timesync-status

# Install chrony (recommended for modern systems)
sudo apt-get install chrony  # Debian/Ubuntu
sudo yum install chrony      # RHEL/CentOS

# Start and enable chrony
sudo systemctl enable chronyd
sudo systemctl start chronyd

# Check sync status
chronyc tracking

# Mount host's localtime (read-only)
docker run -v /etc/localtime:/etc/localtime:ro your-image

# Or set timezone via environment variable
docker run -e TZ=America/New_York your-image

# Update CA certificates package
sudo apt-get update
sudo apt-get install --reinstall ca-certificates

# Rebuild certificate store
sudo update-ca-certificates --fresh

# Restart Docker
sudo systemctl restart docker

# Update CA certificates
sudo yum update ca-certificates
# Or on newer systems
sudo dnf update ca-certificates

# Update trust store
sudo update-ca-trust

# Restart Docker
sudo systemctl restart docker

# Update CA certificates
apk update && apk add --no-cache ca-certificates

# Update certificate store
update-ca-certificates

# Check certificate expiration date
openssl x509 -in ~/.docker/machine/certs/cert.pem -text -noout | grep "Not After"

# Regenerate certificates for a specific machine
docker-machine regenerate-certs my-machine

# Regenerate all certificates including CA
docker-machine regenerate-certs --client-certs my-machine

# If the above fails, you may need to recreate the machine
docker-machine rm my-machine
docker-machine create --driver virtualbox my-machine

# View all certificate files and their expiration
for cert in ~/.docker/machine/certs/*.pem; do
  echo "=== $cert ==="
  openssl x509 -in "$cert" -text -noout | grep -E "(Subject:|Not Before|Not After)"
done

# Check Swarm certificate expiration
docker swarm ca --rotate

# View current Swarm certificates
openssl x509 -in /var/lib/docker/swarm/certificates/swarm-node.crt -text -noout | grep "Not After"

# If certificates are expired, you may need to reinitialize
# WARNING: This will disrupt the cluster
docker swarm leave --force
docker swarm init  # On manager node

# Or force rotation with new expiry
docker swarm update --cert-expiry 8760h  # 1 year

# On all Swarm nodes, verify time is in sync
ansible all -m shell -a "date && timedatectl"

# Or manually check each node
docker node ls
# Then SSH to each node and verify time

# Check registry certificate expiration
echo | openssl s_client -connect your-registry.example.com:443 2>/dev/null | \
  openssl x509 -noout -dates

# View detailed certificate info
echo | openssl s_client -showcerts -connect your-registry.example.com:443 2>/dev/null | \
  openssl x509 -text -noout | head -30

# For Let's Encrypt certificates (using certbot)
sudo certbot renew

# Generate new self-signed certificate for development
openssl req -newkey rsa:4096 -nodes -sha256 \
  -keyout registry.key -x509 -days 365 \
  -out registry.crt \
  -subj "/CN=your-registry.example.com" \
  -addext "subjectAltName=DNS:your-registry.example.com"

# Update the registry with new certificate and restart

# Copy new CA to Docker's cert directory
sudo cp new-ca.crt /etc/docker/certs.d/your-registry.example.com/ca.crt
sudo systemctl restart docker

# Delete existing Kubernetes config
rm -rf ~/.kube/config

# In Docker Desktop settings, disable then re-enable Kubernetes
# This regenerates all certificates

# Check kube-apiserver certificate
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout | grep "Not After"

# Renew certificates with kubeadm
sudo kubeadm certs renew all
sudo systemctl restart kubelet