TLS: certificate is not yet valid
The certificate's notBefore date is in the future according to the client. The certificate is almost always fine: the client's clock is wrong, which is common on containers without a time source, embedded devices with no battery, and virtual machines resumed from a snapshot.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# Compare the two
openssl s_client -connect host:443 </dev/null 2>/dev/null \
| openssl x509 -noout -dates
date -u
# Fix the clock, not the verification
sudo timedatectl set-ntp true
chronyc makestep
# Containers inherit the host clock: fix the host
docker run --rm alpine date -u
# Genuinely early certificate: some CAs backdate by an hour, so
# a freshly issued one can be rejected by a fast clock. Wait, or reissue.How to diagnose TLS errors
TLS errors have a small number of root causes: the certificate is expired, the hostname does not match any SAN entry, the chain is incomplete (the server did not send its intermediates), the issuing CA is not trusted by this client, or the two sides share no cipher or protocol version. The incomplete-chain case is the most deceptive, because browsers often paper over it with cached intermediates while curl, Java and Go fail.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Inspect the live handshake:
openssl s_client -connect host:443 -servername host -showcerts. It shows the full chain the server actually sends. - Check dates and SANs:
openssl x509 -noout -dates -subject -ext subjectAltName. The Common Name is ignored by modern clients: only SANs matter. - If browsers work but curl or your language runtime does not, suspect a missing intermediate. Browsers cache intermediates; other clients do not.
- Verify the trust store the failing client uses. Containers frequently ship without
ca-certificatesinstalled, and Java, Node and Python each have their own store. - For protocol or cipher errors, check the negotiated version and the server's supported list. TLS 1.0 and 1.1 are disabled by default in current clients.
Tools worth reaching for
openssl s_clientopenssl x509 -noout -textcurl -vItestssl.shsslyze
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related TLS errors
- Apache mod_ssl errorApache's SSL module encountered an error, often due to misconfigured SSL directives.
- Certificate chain incompleteSSL certificate chain is missing intermediate certificates, causing trust validation to fail.
- Certificate has expiredThe SSL certificate is past its expiration date and is no longer valid for secure connections.
- Client certificate requiredServer requires client certificate authentication but none was provided.
- curl: (56) OpenSSL SSL_read: Connection reset by peerThe SSL connection was abruptly closed by the remote server, often due to protocol mismatch…
- ERR_SSL_PROTOCOL_ERRORBrowser detected an SSL protocol violation or misconfiguration. Often caused by mixed…
- Hostname verification failedThe SSL certificate's hostname doesn't match the requested domain name.
- Invalid SSL certificateThe SSL certificate is malformed, self-signed, or doesn't meet security requirements.
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.