NTP and time sync: why wrong clocks break TLS, logins, and logs

Incorrect clock synchronization can cause various issues, including breaking TLS/HTTPS connections, failing logins, and disrupting log forensics. This document explains the importance of accurate timekeeping using Network Time Protocol (NTP).

Computers Drift Over Time

Computers use quartz crystals to keep time, but these are not perfectly accurate. Cheap quartz clocks can lose or gain seconds per day, leading to significant drift over time. NTP continuously adjusts the system clock to match a more accurate reference source.

How NTP Works

NTP (Network Time Protocol) uses UDP port 123 to synchronize computer clocks with reference servers. The stratum levels organize these servers:

• Stratum 0: Atomic clocks or GPS directly, not on the network.
• Stratum 1: Servers physically connected to Stratum 0 sources.
• Stratum 2: Servers syncing from Stratum 1 and so forth.

The pool.ntp.org server is a volunteer cloud that most of the world uses by default. It provides reliable time synchronization for devices without direct access to stratum 0 or 1 servers.

What Breaks When Clocks Are Wrong

TLS/HTTPS Issues

TLS certificates have validity windows. If your clock is off by more than a few minutes, you may encounter "invalid certificate" errors on every HTTPS site. Always check the system clock first when a machine distrusts all websites, especially after a dead CMOS battery.

Authentication Problems

Authentication systems like Kerberos reject tickets if they are beyond 5 minutes of skew. This means that logins will fail. Time-based One-Time Password (TOTP) 2FA codes rely on accurate time; any clock drift can result in "invalid code" errors indefinitely.

Log Correlation and Forensics

Inconsistent clocks across multiple machines make it impossible to correlate events accurately. For example, determining which event happened first becomes unanswerable. Trustworthy timestamps are crucial for effective incident response.

Other Time-Dependent Operations

Schedulers, backups, certificate renewals, database replication, and other operations that rely on accurate time can also be disrupted by clock drift. These processes assume a sane time environment to function correctly.

Homelab Practice

In a home lab setting, you should ensure your devices are synchronized with an NTP source. You can either use pool.ntp.org or run a local NTP server (such as chrony on any Linux box or the router). This setup ensures that even if the upstream NTP source misbehaves, only one machine is affected instead of ten.

VMs often drift worse because paused clocks are common. Using hypervisor guest agents or chrony can help maintain accurate time in VMs.

Modern Extras

• NTS (NTPsec): Adds authentication to NTP.
• PTP (Precision Time Protocol): A cousin of NTP for microsecond-grade accuracy, used in finance and telecommunications.
• GPS Hat: A Raspberry Pi with a GPS module can become a Stratum 1 server for around $80.

By ensuring accurate time synchronization, you can avoid many common issues that arise from clock drift.