If the date on a Juniper Networks EX Series Switch is set to a date earlier than the date on which the image was built, the upgrade might fail with the "verify-sig: cannot validate ./certs.pem" message. Setting the date to present will fix this problem. This article explains the steps in this process.
Under some conditions, this upgrade might fail with the following errors if the EX Switch "date" is set earlier than the date on which the image was built:
verify-sig: cannot validate ./certs.pem certificate is not yet valid: /C=US/ST=CA/L=Sunnyvale/O=Juniper Networks/OU=Juniper CA/CN=PackageDevelopment_11_3_0/[email protected]
The following is an example of the full output of the failing upgrade attempt:
root@switch> request system software add jloader-ex-3242-11.3I20110326_0802_hmerge-signed.tgz tar: +CONTENTS: time stamp Mar 26 14:18 2011 is 24166659 s in the future tar: +COMMENT: time stamp Mar 26 14:18 2011 is 24166658 s in the future tar: +DESC: time stamp Mar 26 14:18 2011 is 24166658 s in the future tar: +INSTALL: time stamp Mar 26 14:18 2011 is 24166658 s in the future tar: jloader-ex-3242-11.3I20110326_0802_hmerge.tgz: time stamp Mar 26 14:06 2011 is 24165902 s in the future tar: jloader-ex-3242-11.3I20110326_0802_hmerge.tgz.md5: time stamp Mar 26 14:18 2011 is 24166657 s in the future tar: jloader-ex-3242-11.3I20110326_0802_hmerge.tgz.sha1: time stamp Mar 26 14:18 2011 is 24166656 s in the future tar: jloader-ex-3242-11.3I20110326_0802_hmerge.tgz.sig: time stamp Mar 26 14:18 2011 is 24166656 s in the future tar: certs.pem: time stamp Mar 26 10:02 2011 is 24151315 s in the future verify-sig: cannot validate ./certs.pem certificate is not yet valid: /C=US/ST=CA/L=Sunnyvale/O=Juniper Networks/OU=Juniper CA/CN=PackageDevelopment_11_3_0/[email protected]
The problem is that the date of the switch is set to a date earlier than the date on which the image was built, therefore the certificate for the file is not yet valid. The solution is to either synchronize the date on the switch to an NTP server or to manually set the date. To manually set the date to July 7th 2011 5:00PM, use the following command:
root@switch> set date 201107071700.00 Thu Jul 7 17:00:00 UTC 2011 root@switch>
Running the command request system software add <package-name> will not display any more errors at this point.
request system software add <package-name>
2020-10-21: Article reviewed for accuracy; no changes required
2020-11-13: remove EOS product EX32002023-05-02: Updated KB to reflect that this might happen with regular software upgrades as well. 2023-06-26: Corrected links.