Docker Swarm: Error response from daemon: error while validating Root CA Certificate: x509: certificate has expired or is not yet valid

OS: CentOS 7 VM

Docker latest version

Commands Executed:

   1) docker swarm init
   2) docker swarm join --token SWMTKN-1-3iqtmbz55yvhxkahe2ncs7d9ebxzlzmw1pwhqzvmcemiolef63-3muc4qjs3mbvh53t8ktzzmb22 192.168.10.108:2377 
    Error: Error response from daemon: error while validating Root CA Certificate: x509: certificate has expired or is not yet valid

As you can see, swarm join is giving me this error. What is the reason for this error and where is it coming from?

Regards Aditya

Solution

Had similar issue because swarm init generated ca certificate with start date in future. Possibly due to ntp lag.

CA cert info may be acquired using following command:

docker swarm ca | openssl x509 -noout -text

The output will look something like this:

Certificate:
Data:
    Version: 3 (0x2)
    Serial Number:
        ...
Signature Algorithm: ecdsa-with-SHA256
    Issuer: CN=swarm-ca
    Validity
        Not Before: Oct 24 20:25:00 2018 GMT
        Not After : Oct 19 20:25:00 2038 GMT
    Subject: CN=swarm-ca
    Subject Public Key Info:
        Public Key Algorithm: id-ecPublicKey
            Public-Key: (256 bit)
            pub:
                ...
                ...
                ...
                ...
            ASN1 OID: prime256v1
            NIST CURVE: P-256
    X509v3 extensions:
        X509v3 Key Usage: critical
            Certificate Sign, CRL Sign
        X509v3 Basic Constraints: critical
            CA:TRUE
        X509v3 Subject Key Identifier:
            ...
Signature Algorithm: ecdsa-with-SHA256
     ...
     ...
     ...
     ...

You can see the range of validity is between Oct 24 20:25:00 2018 GMT and Oct 19 20:25:00 2038 GMT. If the machine trying to join the swarm doesn't have its clock in that interval, it will fail with that error.