Time synchronization
Accurate time is important for secure connections, certificate validation, log correlation, and device attestation. Devices keep their clocks synchronized over the network using NTP.
Default behavior
Devices use chrony as their NTP client. Out of the box a device
ships without a custom time configuration, so it synchronizes against the
public pools that its Linux distribution configures by default — typically
ntp.ubuntu.com and the 0–2.ubuntu.pool.ntp.org pools. A device with
internet access therefore keeps accurate time without any configuration.
Treat those pool names as a default that can change with the distribution, not
as a contract. If you need to know exactly what a given device is using, read
/etc/chrony/chrony.conf on the device, and set your own sources if the answer
matters to your firewall rules.
Setting custom NTP servers
If your environment requires specific time sources — for example, internal NTP servers on an isolated network — you can provide your own NTP configuration. You can set it:
- at image creation, so it applies from first boot, or
- by placing a
chrony-format configuration at/isodevice/config/chrony.confon the device.
When custom NTP settings are provided, they take effect early in the boot process so the device’s clock is correct before it contacts the platform.
When a device cannot reach a time source
A device with no reachable NTP source keeps running, but its clock is left to drift against whatever the hardware clock holds. Once the drift is large enough, certificate validity checks start to fail, and the symptom you see is a device that appears offline in the dashboard even though its network is otherwise healthy — the TLS handshake to the platform cannot complete.
This failure is easy to misread, because the device can still reach the internet. If a device will not come online, check its clock before you go looking at firewall rules. See Troubleshooting.
Recommendations
- On networks without internet access, always configure reachable internal NTP servers; otherwise the device cannot correct its clock, which can cause secure connections and attestation to fail.
- Make sure outbound UDP 123 to your time sources is allowed — see Connectivity & ports.
A device whose clock is far off may be unable to establish TLS connections to the platform and may fail attestation. If a device cannot come online and you suspect time, verify it can reach an NTP source.
Related
- Connectivity & ports — NTP egress a device needs.
- Troubleshooting — when a device will not come online.
- Networking — the rest of this section.
- Settings supplied as files — where a custom NTP configuration goes on a device.
- Create an install image — setting initial time sources in an install image.