This article explains the MX upgrade failure with the error "verify-sig: cannot validate ecerts.pem"

You may see the following or similar output:

user@re0> request system software add /var/tmp/jinstall64-13.3R3-S11-domestic-signed.tgz no-validate

Installing package '/var/tmp/jinstall64-13.3R3-S11-domestic-signed.tgz' ...
verify-sig: cannot validate ecerts.pem.                        
.
certificate has expired:/C=US/ST=CA/L=Sunnyvale/O=Juniper Networks/OU=Juniper CA/CN=PackageProductionEc_2015/[email protected]
./+REQUIRE: /var/tmp/pa4501.52/jinstall64-13.3R3-S11-domestic-signed.x4501/jinstall64_pkg/bin/checkpic: Authentication error

WARNING: This installation attempt will be aborted.
WARNING: you may use the 'force' option on the command line.
ERROR: jinstall fails requirements check
Installation failed for package '/var/tmp/jinstall64-13.3R3-S11-domestic-signed.tgz'

The image you are attempting to install was built on a later date than the current date/time set on the device. This causes a mismatch with the image's digital signature, as the certificate embedded within the image is not yet valid at the current device time. To resolve this, please synchronize the device's clock with the certificate and manually adjust the system time:

show system certificate <cert-name>
show system uptime

root@switch> set date (YYYYMMDDhhmm.ss)

If the time is correct and it still throws the error, please add the "force" knob with the upgrade command as it is just a warning message.

user@re0> request system software add /var/tmp/jinstall64-13.3R3-S11-domestic-signed.tgz no-validate force