An out-of-sync system clock causes subtle but real problems — SSL certificate validation failures, authentication errors, incorrect log timestamps, and more. This guide covers diagnosing and fixing time sync issues.
Why Accurate Time Matters
- SSL/TLS certificate validation depends on accurate time (a clock too far off can cause certificates to appear expired or not-yet-valid)
- Authentication protocols (like Kerberos) often have strict time-sync tolerance requirements
- Log timestamps become unreliable for troubleshooting/correlation if the clock is wrong
- Scheduled tasks (cron) run at the wrong actual time if the clock is off
Checking Current Time and Sync Status
timedatectlShows current time, timezone, and whether NTP synchronization is active and working.
Verifying NTP Sync Is Actually Enabled
timedatectl set-ntp trueChecking Detailed Sync Status
timedatectl show -p NTPSynchronizedShould return yes — if not, something is preventing successful synchronization.
Checking systemd-timesyncd Status (Default on Many Distributions)
sudo systemctl status systemd-timesyncdUsing chrony (Alternative, Often More Robust for Servers)
sudo apt install chrony -y
sudo systemctl enable --now chronydchrony is generally considered more capable than systemd-timesyncd for server environments, particularly for handling network interruptions gracefully and achieving tighter synchronization.
Checking chrony Sync Status
chronyc trackingShows current offset from reference time and synchronization status in detail.
Checking Which NTP Servers Are Being Used
chronyc sourcesManually Forcing a Time Sync
sudo chronyc makestepForces an immediate correction rather than waiting for gradual adjustment — useful if the clock is significantly off and you want it corrected immediately rather than slewed gradually.
Checking for Firewall Issues Blocking NTP
sudo ufw allow out 123/udpNTP uses UDP port 123 — verify outbound access isn't blocked, which would prevent synchronization entirely.
Common Causes of Time Drift on a VPS
- NTP service not running or not properly configured
- Firewall blocking outbound NTP traffic
- Virtualization-layer clock drift (less common on modern hypervisors, but historically a known VM-specific issue)
Verifying Timezone Configuration Is Also Correct
timedatectl list-timezones | grep America
sudo timedatectl set-timezone America/New_YorkDistinct from time sync accuracy — verify your configured timezone is also actually correct for your needs, separate from whether the underlying UTC time itself is accurately synchronized.
Common Errors
SSL certificate errors that don't make sense given a valid certificate — always check system time first when encountering seemingly inexplicable certificate validation failures; a surprisingly common root cause.
Continue Reading
- How to Set the Correct Timezone and Enable NTP on a Linux VPS
- Common SSL Certificate Errors and How to Fix Them
- How to Correlate Logs, Metrics, and Traces During an Incident
Browse more articles in Troubleshooting & FAQ.
