FreeBSD 13 – severe time drift breaks TLS and auth – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Certificate validation, Kerberos, and token-based auth fail when host time drifts significantly.

Environment & Reproduction

Common on VMs with bad host clock sync or disabled NTP daemon.

date -u
service ntpd status
ntpq -p

Root Cause Analysis

Clock source instability or absent synchronization causes offset growth beyond authentication tolerances.

Quick Triage

Check offset, stratum, and upstream reachability.

ntpdate -q pool.ntp.org
ntpq -pn
vmstat -i | head

Step-by-Step Diagnosis

Inspect ntpd logs and confirm step/slew behavior.

grep -i ntp /var/log/messages | tail -n 80
sysctl kern.timecounter.choice
sysctl kern.timecounter.hardware

Solution – Primary Fix

Enable and configure ntpd with reliable peers, then force initial sync.

sysrc ntpd_enable=YES
sysrc ntpd_sync_on_start=YES
service ntpd restart

Solution – Alternative Approaches

Use chrony in specialized environments or sync from trusted internal NTP stratum servers.

Verification & Acceptance Criteria

Offset remains low and TLS/auth workflows succeed without time-related errors.

ntpq -p
date -u
fetch -o - https://example.com

Rollback Plan

Restore previous time service configuration if compatibility issues arise.

cp -a /etc/ntp.conf /etc/ntp.conf.rollback
service ntpd stop

Prevention & Hardening

Alert on offset thresholds and validate time sync during host provisioning checks.

Related Errors & Cross-Refs

Closely related to OCSP failures, package signature errors, and SSO token rejection.

Related tutorial: View the step-by-step tutorial for freebsd-13.

View all freebsd-13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

ntpd(8), ntp.conf(5), and FreeBSD time synchronization guidance.