---
checkId: check.timestamp.timesync.system
plugin: stellaops.doctor.timestamping
severity: fail
tags: [timestamping, timesync, ntp, system]
---
# System Time Synchronization

## What It Checks
Checks that the system clock is synchronized with NTP servers. The check:

- Queries configured NTP servers (defaults to `time.nist.gov` and `pool.ntp.org`) using the NTP protocol (UDP port 123).
- Computes the time skew between the local system clock and each NTP server.
- **Fails** (unhealthy) if skew exceeds the critical threshold (default 5 seconds).
- **Warns** (degraded) if skew exceeds the warning threshold (default 1 second).
- Reports degraded if no NTP servers can be reached.

## Why It Matters
Accurate system time is fundamental to timestamping. Clock skew causes timestamp tokens to have incorrect genTime values, which can invalidate evidence during verification. Large skew can also cause TLS certificate validation failures, authentication token rejection, and incorrect audit log ordering.

## Common Causes
- NTP service not running (chrony, ntpd, systemd-timesyncd)
- NTP servers unreachable (firewall blocking UDP 123)
- Virtual machine time drift (especially paused/resumed VMs)
- Hardware clock issues

## How to Fix

### Docker Compose
Docker containers inherit the host's clock. Fix time sync on the Docker host:

```bash
# Check host time sync
timedatectl status

# Enable NTP sync
sudo timedatectl set-ntp true

# Or configure chrony
sudo systemctl restart chronyd
```

### Bare Metal / systemd
```bash
# Check time sync status
timedatectl status
chronyc tracking

# Force sync
sudo chronyc makestep

# Enable NTP
sudo timedatectl set-ntp true
sudo systemctl enable chronyd
```

### Kubernetes / Helm
Kubernetes nodes must have NTP configured. Verify on each node:

```bash
# On each node
timedatectl status
chronyc tracking
```

Ensure NTP is part of your node provisioning configuration.

## Verification
```
stella doctor run --check check.timestamp.timesync.system
```

## Related Checks
- `check.timestamp.timesync.tsa-skew` — checks skew between system clock and TSA genTime
- `check.timestamp.timesync.rekor-correlation` — checks TST-Rekor time correlation