What can I do for when my 'certificate is not yet valid'?
This troubleshooting guide helps you eliminate the error of not having a valid HTTPS certificate.
Sometimes, when executing certain commands on k3OS, you may encounter an error saying that the SSL certificate is not yet valid. This problem can occur if the system’s date and time are not properly configured, especially if you are in a restricted network that does not allow your device to retrieve the current date and time via Network Time Protocol (NTP). In this article, we will discuss two possible issues that can cause this problem and provide solutions for each.
While executing the command
export VERIFY_CHECKSUM=false && curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 && chmod 700 get_helm.sh && ./get_helm.sh on k3OS you might get a error message like this:
curl: (60) SSL certificate problem: certificate is not yet valid More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.
Checking the time with
date results in a timestamp from 2017. There are two possible solutions.
Possible solution #1: configure NTP
The time is not configured properly. It can happen that your NTP server is blocked (especially if you are inside a university network).
You can verify that by entering
sudo ntpd -d -q -n -p 0.de.pool.ntp.org. If you get a result like this, then it is definitely blocked:
ntpd: '0.de.pool.ntp.org' is 188.8.131.52 ntpd: sending query to 184.108.40.206 Alarm clock
- We recommend using the NTP server from the local university or ask your system administrator.
For the RWTH Aachen / FH Aachen you can use
sudo ntpd -d -q -n -p ntp1.rwth-aachen.de as specified here
Possible solution #2: set hardware clock via BIOS
- Go into the BIOS
- Set the hardware clock of the device manually.
k3OS reports errors, due to hardware date being in the past. (e.g., 01.01.2017).
Example: during startup the k3s certificates are generated. However, it is still using the hardware time. Even after setting the time manually with NTP, it wont let you connect with k3s as the certificates created during startup are not not valid anymore. Setting the time is not persisted during reboots.
Steps to Reproduce
- Install k3os, without updating BIOS clock
- Install UMH
- Helm will fail on Install step, due to outdated certificates.
- Load cloudinit with added ntp_servers on OS install. You can use the one at https://www.umh.app/development.yaml
Be careful: you need to host it on a HTTP server (not HTTPS) as you would get other certificate issues while fetching it.