FreeBSD 12 – severe clock drift breaks TLS and scheduled jobs – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

TLS handshakes fail and cron workloads misfire due to time offset.

Environment & Reproduction

Often on virtual hosts without stable clocksource or NTP misconfiguration.

Root Cause Analysis

Time synchronization service is disabled, blocked, or selecting bad peers.

Quick Triage

Check current offset, peer status, and firewall access to time servers.

Step-by-Step Diagnosis

Examine NTP discipline logs and measure drift over short interval.

Solution – Primary Fix

Correct NTP configuration, sync immediately, and persist daemon startup.

Solution – Alternative Approaches

Use local stratum source when outbound NTP is restricted.

Verification & Acceptance Criteria

Offset remains within policy threshold and TLS errors disappear.

Rollback Plan

Revert time service config changes and restore known-good peer list.

Prevention & Hardening

Alert on drift thresholds and test NTP reachability continuously.

Related Errors & Cross-Refs

Related to certificate validation failures and Kerberos skew rejections.

Related tutorial: View the step-by-step tutorial for FreeBSD 12.

View all FreeBSD 12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

ntpd(8), chronyd documentation, and FreeBSD timekeeping notes.