Fixing NTP Time Synchronization Failures on Linux

Incorrect system time can cause authentication failures, log inconsistencies, and application errors. I encountered this when a server's clock drifted by several minutes, breaking SSL certificates. This guide covers NTP troubleshooting on Linux.

Environment

OS: Ubuntu 22.04 LTS
NTP service: systemd-timesyncd (default)
Alternative: chrony

$ timedatectl
               Local time: Sat 2025-05-28 10:00:00 WET
           Universal time: Sat 2025-05-28 10:00:00 UTC
                 RTC time: Sat 2025-05-28 10:05:30
                Time zone: Europe/Lisbon (WET, +0000)
System clock synchronized: no              <-- Problem!
              NTP service: active
          RTC in local TZ: no

The Problem

# Check time difference
$ chronyc tracking
# Or with systemd-timesyncd:
$ timedatectl show-timesync

# Applications failing due to time drift
$ curl -I https://api.example.com
curl: (60) SSL certificate problem: certificate is not yet valid

Analysis

Step 1: Check Current NTP Status

# For systemd-timesyncd
$ timedatectl status
               Local time: Sat 2025-05-28 10:00:00 WET
System clock synchronized: no
              NTP service: active

# Check timesyncd details
$ systemctl status systemd-timesyncd
● systemd-timesyncd.service - Network Time Synchronization
     Loaded: loaded (/lib/systemd/system/systemd-timesyncd.service; enabled; vendor preset: enabled)
     Active: active (running) since Sat 2025-05-28 08:00:00 WET; 2h ago

# Check chrony (if installed)
$ chronyc sources
210 Number of sources = 0   <-- No sources configured!

Step 2: Check Network Connectivity

# Test NTP server reachability
$ ntpdate -q pool.ntp.org
server 192.168.1.1, stratum 2, offset -0.001234, delay 0.02345

# Check DNS resolution
$ nslookup pool.ntp.org
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   pool.ntp.org
Address: 192.168.1.100

# Check firewall
$ sudo iptables -L -n | grep 123
# UDP port 123 must be open for NTP

Step 3: Check Configuration

# Check timesyncd config
$ cat /etc/systemd/timesyncd.conf
[Time]
NTP=0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org
FallbackNTP=ntp.ubuntu.com
RootDistanceMaxSec=5
PollIntervalMinSec=32
PollIntervalMaxSec=2048

Solution

Fix 1: Enable and Restart NTP Service

# For systemd-timesyncd
$ sudo systemctl enable systemd-timesyncd
$ sudo systemctl restart systemd-timesyncd

# Verify
$ timedatectl status
System clock synchronized: yes

# Force immediate sync
$ sudo timedatectl set-ntp true

Fix 2: Configure NTP Servers

# Edit timesyncd configuration
$ sudo nano /etc/systemd/timesyncd.conf

[Time]
NTP=0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org
FallbackNTP=0.arch.pool.ntp.org 1.arch.pool.ntp.org
RootDistanceMaxSec=5
PollIntervalMinSec=32
PollIntervalMaxSec=2048

# Restart service
$ sudo systemctl restart systemd-timesyncd

Fix 3: Switch to chrony (Recommended)

# Install chrony
$ sudo apt install chrony

# Stop timesyncd
$ sudo systemctl stop systemd-timesyncd
$ sudo systemctl disable systemd-timesyncd

# Enable chrony
$ sudo systemctl enable chrony
$ sudo systemctl start chrony

# Verify
$ chronyc sources
210 Number of sources = 4
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* ntp.ubuntu.com               2   6   377    12   -0.5ms[  -0.8ms] +/-  15ms
^+ 0.pool.ntp.org               2   6   377    15   +1.2ms[  +0.9ms] +/-  20ms

Fix 4: Manual Time Sync

# Install ntpdate
$ sudo apt install ntpdate

# Sync time manually
$ sudo ntpdate pool.ntp.org
28 May 10:00:00 ntpdate[12345]: adjust time server 192.168.1.100 offset -0.001234 sec

# Verify
$ timedatectl status
System clock synchronized: yes

Fix 5: Fix Firewall for NTP

# Allow NTP traffic (UDP port 123)
$ sudo ufw allow 123/udp

# Or using iptables
$ sudo iptables -A INPUT -p udp --dport 123 -j ACCEPT
$ sudo service iptables save

Verify Time Synchronization

# Check sync status
$ timedatectl status | grep synchronized
System clock synchronized: yes

# Check time offset
$ chronyc tracking
Reference ID    : C0A80164 (ntp.ubuntu.com)
Stratum         : 3
System time     : 0.000001234 seconds slow of NTP time
Last offset     : -0.000000567 seconds

# Test SSL certificates work
$ curl -I https://api.example.com
HTTP/1.1 200 OK

Lessons Learned

Always verify NTP sync after server deployment - time drift causes subtle issues.
chrony is preferred over systemd-timesyncd for better accuracy and reliability.
Allow UDP 123 through firewalls for NTP to work.
Monitor time drift with periodic checks to catch issues early.
Use multiple NTP servers for redundancy.

This blog does not accept any external sponsorships, affiliate marketing, or ad revenue.