Ubuntu 26.04 LTS – system time drift breaks TLS and auth flows – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Clock skew causes certificate validation failures, token rejections, and scheduling issues.

Environment & Reproduction

Often occurs on VMs with paused clocks or misconfigured NTP peers.

timedatectl status
systemctl status systemd-timesyncd --no-pager
chronyc tracking
date -u

Root Cause Analysis

NTP client is disabled, blocked, or pointed at unreachable servers, causing persistent drift.

Quick Triage

Check synchronization state and selected time source.

timedatectl show-timesync --all
resolvectl query ntp.ubuntu.com
journalctl -u systemd-timesyncd -n 80 --no-pager

Step-by-Step Diagnosis

Measure offset repeatedly and verify outbound NTP reachability.

watch -n 2 timedatectl
chronyc sources -v
ss -lunp | grep 123

Solution – Primary Fix

Enable one time-sync service, configure valid peers, and force immediate sync.

sudo timedatectl set-ntp true
sudo systemctl restart systemd-timesyncd
sudo timedatectl timesync-status
sudo hwclock --systohc

Solution – Alternative Approaches

Use chrony for stricter environments with custom NTP hierarchy.

sudo apt install chrony -y
sudo systemctl disable --now systemd-timesyncd
sudo systemctl enable --now chrony
chronyc makestep

Verification & Acceptance Criteria

Accepted when synchronized flag is true and offset remains within defined SLA.

timedatectl status
chronyc tracking
date -u

Rollback Plan

Revert to previous time daemon setup if application compatibility issues appear.

sudo systemctl disable --now chrony
sudo systemctl enable --now systemd-timesyncd

Prevention & Hardening

Monitor drift metrics and enforce redundant NTP server definitions.

timedatectl show-timesync --all
chronyc sourcestats -v
systemctl is-active systemd-timesyncd chrony

Related Errors & Cross-Refs

Related errors include certificate not yet valid, clock skew too great, and Kerberos preauthentication failed.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

systemd-timesyncd and chrony manuals, Ubuntu time synchronization guidance, and TLS troubleshooting docs.