Clock Skew

What a Wrong Clock Breaks

A wrong clock causes three different problems, and the errors rarely mention the clock:

• Anchor refuses a credential whose start time is more than ten minutes ahead of its own clock. A machine whose clock is ten minutes slow therefore cannot start with a credential it has just received or renewed. The error names the credential, not the clock.
• Two machines whose clocks are two hours apart cannot connect at all. The error is a TLS alert that looks exactly like the one for a wrong realm.
• A clock that is weeks fast makes a current credential look expired. A clock that is a year slow makes an expired credential look valid.

What Conflux Checks

Each time conflux calls the API, it compares the server's time with the local clock. If they differ by more than ten minutes, conflux refuses to bring the machine up. It writes this to the service log:

conflux: this machine's clock is 12m3s away from the server's, and the overlay will not start or connect on it.
  fix the clock first (timedatectl set-ntp true, or the equivalent), then try again

In the terminal, up or start reports only that no anchor came up within 90 seconds, and names the log.

sudo conflux status shows the last measured skew when it is over one second. Past the limit, the row also shows the fix:

  clock        off by 12m3s — past the 10m anchor allows; fix the clock (timedatectl set-ntp true)

Conflux measures the skew only when it calls the API, which it does when it enrols and when it renews.

Fixing the Clock

A machine that stayed off long enough for its credential to expire renews on its next start. See Failing Renewals.