Docker Login X509 Certificate Expired [Solved]

Issue	Common Cause	Primary Fix
Docker Login Failure	System clock desynchronization	Sync system time with NTP
x509: certificate expired	Outdated CA certificates	Update `ca-certificates` package
Registry Connection Error	Registry SSL certificate expired	Renew SSL on registry server

Table of Contents

What is the Docker Login x509 Certificate Expired Error?

The “x509: certificate has expired or is not yet valid” error occurs when the Docker client fails to establish a secure TLS connection with a container registry.

This error typically happens during the docker login command. It indicates that the security certificate presented by the registry (like Docker Hub or a private Harbor instance) is being rejected by your local machine.

The root cause is usually one of two things: your local system time is incorrect, making a valid certificate appear expired, or the registry’s certificate has actually reached its end-of-life.

Step-by-Step Solutions

1. Synchronize System Time

The most frequent cause of x509 errors is a drifted system clock. If your computer thinks it is 2020, every modern certificate will appear “not yet valid” or “expired.”

On Ubuntu/Debian, use the following commands to sync your time:

sudo apt-get install ntpdate
sudo ntpdate pool.ntp.org

For systems using timedatectl:

sudo timedatectl set-ntp on
timedatectl status

2. Update Local CA Certificates

If your system’s trust store is outdated, it may not recognize the root authorities used by the registry. Updating the ca-certificates package often resolves this.

sudo apt-get update
sudo apt-get install --reinstall ca-certificates
sudo update-ca-certificates

3. Restart the Docker Daemon

Docker caches certain certificate information. After updating your system time or CA store, a restart of the Docker service is required to pick up the changes.

sudo systemctl restart docker

4. Verify Registry Certificate Status

If the steps above do not work, the issue might be on the server side. You can check the expiration date of the registry’s certificate using openssl:

openssl s_client -showcerts -connect your-registry-domain.com:443

Look for the “Not After” date in the output. If the date has passed, the administrator of the registry must renew the SSL certificate.

5. Troubleshooting WSL2 (Windows Users)

WSL2 often suffers from time desync after a laptop wakes up from sleep. If you are using Docker Desktop with WSL2, run this inside your WSL terminal:

sudo hwclock -s