RuntimeException: org.bouncycastle.cert.CertException: certificate not valid yet

Q: Restart Docker Desktop / Docker Daemon

When to use: Use this on Mac or Windows where Docker runs in a VM.. Docker Desktop VMs can suffer from clock drift if the laptop was asleep. Restarting the daemon resyncs the VM clock with the host.

Q: Mount the host's time into the container

When to use: Use this if you are running Docker on Linux and time drift is persistent.. Bind-mount the `/etc/localtime` file to ensure the container uses the host's exact timezone.

Q: Use NTP in Dockerfile

When to use: Use this if you are running a custom base image and need guaranteed time sync.. Install an NTP client and sync time on container startup.

Q: Disable SSL Verification (DEV ONLY)

When to use: Use this ONLY for local testing if you cannot fix the clock.. Configure your RestTemplate or WebClient to trust all certificates, bypassing the date check. NEVER do this in production.

Q: Fix the host machine clock

When to use: Use this if the host OS time is also wrong.. If the host machine's clock is wrong, Docker will inherit the wrong time. Sync the host OS.

🔴 The Error You're Seeing

Confirm this matches your console output. If it does, you're in the right place.

ERROR LOG

2026-02-20 15:05:55.800 ERROR 8842 --- [nio-8080-exec-1] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] threw exception

java.lang.RuntimeException: org.bouncycastle.cert.CertException: certificate not valid yet
	at org.bouncycastle.cert.jcajce.JcaX509CertificateHolder.validate(JcaX509CertificateHolder.java:432)

⚡ Quick Fix Works 80% of the time

Restart Docker Desktop or sync the container's clock with the host machine.

# On Mac/Windows, restart Docker Desktop
# On Linux, sync time in container:
docker run -it --rm --privileged alpine hwclock -s

🧠 Why this Happens

Tap to expand the deep technical explanation

Your Spring Boot app (running inside Docker) tried to make an HTTPS request. The SSL certificate presented by the server has a 'Not Before' date (e.g., Feb 20, 2026). However, the system clock inside your Docker container is stuck in the past (e.g., Jan 1, 2020). Because the current time is before the certificate's issue date, Java rejects it as invalid.

The HITEC City Parking Spot Analogy:

It's like showing up for a train at 10:00 AM, but your watch says 8:00 AM. The conductor says your ticket isn't valid yet because your watch is wrong.

🔁 How to Reproduce Confirm this is your error

Change your computer's clock to 5 years in the past. Start a Spring Boot app. Try to call an external HTTPS API. It will fail.

🛠️ Solutions (5 Ways to Fix)

Solution 1✓ Most common cause

Restart Docker Desktop / Docker Daemon

👉 Use this on Mac or Windows where Docker runs in a VM.

Docker Desktop VMs can suffer from clock drift if the laptop was asleep. Restarting the daemon resyncs the VM clock with the host.

# Mac/Windows:
# Click 'Restart' in Docker Desktop

# Linux:
sudo systemctl restart docker

Solution 2

Mount the host's time into the container

👉 Use this if you are running Docker on Linux and time drift is persistent.

Bind-mount the `/etc/localtime` file to ensure the container uses the host's exact timezone.

docker run -v /etc/localtime:/etc/localtime:ro -p 8080:8080 my-spring-app

Solution 3

Use NTP in Dockerfile

👉 Use this if you are running a custom base image and need guaranteed time sync.

Install an NTP client and sync time on container startup.

# Dockerfile
RUN apk add --no-cache openntp
CMD ["ntpd", "-d", "-p", "pool.ntp.org"]

Solution 4

Disable SSL Verification (DEV ONLY)

👉 Use this ONLY for local testing if you cannot fix the clock.

Configure your RestTemplate or WebClient to trust all certificates, bypassing the date check. NEVER do this in production.

// WARNING: DANGEROUS IN PRODUCTION
// Use InsecureTrustSupportFactory to bypass SSL checks

Solution 5

Fix the host machine clock

👉 Use this if the host OS time is also wrong.

If the host machine's clock is wrong, Docker will inherit the wrong time. Sync the host OS.

# Linux:
sudo ntpdate ntp.ubuntu.com
# Windows:
w32tm /resync

📋 Version Notes

Spring Boot 2.x

Uses Java 8/11 SSL stack. Less descriptive errors.

Spring Boot 3.x

Uses Java 17+ SSL stack. Bouncycastle errors are more prominent.

🛡️ How to Prevent This Next Time

When running Spring Boot in Docker on a laptop, always disable sleep mode for the Docker VM, or use `docker-compose` with `privileged: true` to allow time sync.