{"id":903,"date":"2026-08-16T22:49:56","date_gmt":"2026-08-16T22:49:56","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=903"},"modified":"2026-08-25T22:05:12","modified_gmt":"2026-08-25T22:05:12","slug":"vps-clock-drift-time-sync-chrony-setup","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/","title":{"rendered":"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A VPS clock that drifts by even a few seconds causes failures that look completely unrelated: TLS certificates suddenly rejected as &#8220;not yet valid,&#8221; cron jobs that fire at the wrong time, log entries that arrive out of order during an incident, and rate-limiters that trip for no apparent reason. Virtual machines are especially prone to drift because they have no direct access to a hardware clock \u2014 they depend entirely on the hypervisor&#8217;s timekeeping, which degrades under host load. This article explains how to measure the drift, why it breaks TLS and automation, and how to set up chrony so your server&#8217;s clock stays trustworthy. If you are evaluating providers, our <a href=\"https:\/\/virtualserversvps.com\/#providers\">VPS comparison table<\/a> lists which hosts include proper time sync infrastructure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why VPS Clocks Drift in the First Place<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A physical server has a battery-backed RTC (real-time clock) and keeps time with hardware interrupts. A VM has neither: the guest kernel reads time from the hypervisor (kvm-clock, Xen, or Hyper-V time source), and that source is only as accurate as the host&#8217;s scheduling. When the host is busy, timer interrupts to your guest are delayed, and the guest clock accumulates error. On a loaded neighbor&#8217;s host, drift of tens of milliseconds per hour \u2014 up to a second or more per day \u2014 is routine. Most VPS images install a time-sync daemon, but many minimal images and Docker-optimized templates do not, which is how a server quietly ends up minutes off without anyone noticing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What a Wrong Clock Breaks<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>TLS certificate validation:<\/strong> a client that thinks it is 2024 will reject a certificate that is valid from 2025-2027. The reverse also happens: an expired client certificate on your server breaks outgoing mTLS connections.<\/li><li><strong>OCSP stapling and renewal:<\/strong> certbot&#8217;s renewal checks and OCSP responses depend on sane timestamps; a skewed clock causes spurious &#8220;certificate expired&#8221; alerts.<\/li><li><strong>cron and systemd timers:<\/strong> jobs scheduled at 03:00 run at 03:00:47 (or not at all if the clock jumps over the scheduled minute).<\/li><li><strong>Log forensics and correlation:<\/strong> during an incident, logs from your VPS, your CDN, and your provider&#8217;s firewall must line up; a 90-second offset makes root-cause analysis painful.<\/li><li><strong>Authentication and rate limiting:<\/strong> TOTP tokens, Kerberos tickets, and many API rate-limiters check timestamps with tight windows (30-300 seconds).<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Measure Your Current Drift First<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before changing anything, establish the baseline:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>timedatectl\ntimedatectl timesync-status\nchronyc tracking     # if chrony is installed<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>timedatectl<\/code> shows whether NTP sync is active and what the current offset is. An offset above 50 ms on an idle server is already a sign of poor timekeeping; above a second means something is actively broken (wrong timezone, sync daemon not running, or blocked UDP 123 egress). If NTP sync is off entirely, that is your answer \u2014 the clock has been drifting since boot.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">chrony vs systemd-timesyncd vs ntpd<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Three daemons dominate Linux time sync. All three can keep a VPS within milliseconds of UTC, but they differ in fit:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Daemon<\/th><th>Typical accuracy<\/th><th>Setup effort<\/th><th>NTS support<\/th><th>Best for<\/th><\/tr><\/thead><tbody><tr><td>chrony<\/td><td>&lt;1 ms on good networks<\/td><td>Low<\/td><td>Yes (4.0+)<\/td><td>VPSes, VMs, laptops, NTP servers<\/td><\/tr><tr><td>systemd-timesyncd<\/td><td>1-10 ms<\/td><td>None (built-in)<\/td><td>No<\/td><td>Simple desktops and minimal servers<\/td><\/tr><tr><td>ntpd (ntpsec)<\/td><td>1-10 ms<\/td><td>Moderate<\/td><td>No (ntpsec: partial)<\/td><td>Legacy networks, some appliances<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For a VPS, chrony is the standard recommendation: it syncs faster at boot, handles network interruptions gracefully (it remembers drift between restarts), and \u2014 critically for security-focused setups \u2014 supports NTS for authenticated time. It is also the default on RHEL-family distributions and easily installed on Debian\/Ubuntu.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Installing and Configuring chrony<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install chrony        # Debian\/Ubuntu\ndnf install chrony        # RHEL\/Rocky\/Alma<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The default <code>\/etc\/chrony\/chrony.conf<\/code> is sane, but two settings matter on a VPS. First, pick pool servers close to your datacenter (your provider usually publishes their NTP pool \u2014 prefer it, since it is the lowest-latency path). Second, make sure the <code>makestep<\/code> directive allows a large initial correction \u2014 a freshly restored snapshot can be minutes off, and you want chrony to step rather than slew slowly:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pool your-provider-ntp.example iburst\nmakestep 1 3\nrtcsync<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then restart and verify:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl restart chrony\nchronyc sources -v      # ^* next to a source = synced\nchronyc tracking        # watch System time offset approach 0<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">NTS: Authenticated Time for Security-Conscious Servers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Plain NTP is unauthenticated: an attacker who can intercept UDP 123 traffic can shift your clock, which is a real attack \u2014 skewed clocks have been used to let expired certificates pass, poison logs, and disrupt TOTP-based authentication. NTS (Network Time Security, RFC 8915) authenticates the server to the client and encrypts the timestamps, closing that vector. With chrony 4.0+, enabling it is a one-line change per server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>server time.cloudflare.com iburst nts<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Several public pools (Cloudflare, Netnod, and some national metrology institutes) offer NTS. Confirm it works with <code>chronyc -N sources<\/code> \u2014 NTS-enabled sources show an <code>N<\/code> flag and authenticate over port 443 (TCP), which also conveniently works on networks that block UDP 123. For a production VPS handling TLS, authentication, or anything regulated, NTS is now the default choice rather than an exotic extra.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Time After Reboots and Snapshots<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Two VPS-specific gotchas remain. First, after restoring from a snapshot or moving to a new host, the clock can be minutes behind \u2014 always run <code>chronyc makestep<\/code> (or just restart chrony with the <code>makestep 1 3<\/code> config above) immediately after a restore, before services start. Second, if you ever run an NTP server yourself, do not point it at public clients: unauthenticated open NTP servers are abused for amplification attacks, and your provider will notice. Keep chrony in client mode, and let your upstream pools do the serving.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Accurate time is one of those quiet dependencies that only gets attention when it breaks \u2014 usually at 3 AM during an incident. Five minutes of chrony configuration eliminates an entire class of confusing failures. If you are about to provision a new server, <a href=\"https:\/\/virtualserversvps.com\/#features\">our feature comparison page<\/a> covers operational extras like monitoring and snapshots that different providers offer.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A VPS clock that drifts by even a few seconds causes failures that look completely unrelated: TLS certificates suddenly rejected as &#8220;not yet valid,&#8221; cron jobs that fire at the&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":8,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-903","post","type-post","status-publish","format-standard","hentry","category-security-compliance"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux - Virtual Servers VPS Blog<\/title>\n<meta name=\"description\" content=\"A VPS clock that drifts by even a few seconds causes failures that look completely unrelated: TLS certificates suddenly rejected as &quot;not yet valid,&quot; cron\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux\" \/>\n<meta property=\"og:description\" content=\"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-16T22:49:56+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-25T22:05:12+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/\",\"name\":\"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-08-16T22:49:56+00:00\",\"dateModified\":\"2026-08-25T22:05:12+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"description\":\"A VPS clock that drifts by even a few seconds causes failures that look completely unrelated: TLS certificates suddenly rejected as \\\"not yet valid,\\\" cron\",\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux - Virtual Servers VPS Blog","description":"A VPS clock that drifts by even a few seconds causes failures that look completely unrelated: TLS certificates suddenly rejected as \"not yet valid,\" cron","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/","og_locale":"en_US","og_type":"article","og_title":"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux","og_description":"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux","og_url":"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-08-16T22:49:56+00:00","article_modified_time":"2026-08-25T22:05:12+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/","url":"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/","name":"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-08-16T22:49:56+00:00","dateModified":"2026-08-25T22:05:12+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"description":"A VPS clock that drifts by even a few seconds causes failures that look completely unrelated: TLS certificates suddenly rejected as \"not yet valid,\" cron","breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/vps-clock-drift-time-sync-chrony-setup\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"VPS Clock Drift: How to Fix Time Sync Issues with chrony on Linux"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/903","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=903"}],"version-history":[{"count":2,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/903\/revisions"}],"predecessor-version":[{"id":971,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/903\/revisions\/971"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=903"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=903"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=903"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}