Time & Certificates
Keep one true clock with NTP and chrony, read a TLS certificate with openssl, and catch its expiry before your customers do.
An interactive Linux lesson: 20 steps, about 30 minutes, on a live simulation in your browser.
The lamp shop on web01 emails its sales totals every night. The line in your table says 0 2 *: 02:00, every day. It ran at 02:00 all winter, and this week the warehouse team says the numbers arrive an hour off. Nobody edited the table.
Look at the machine first: date says what time it is here, timedatectl says how the machine keeps it, and crontab -l shows the job. The schedule lens above the terminal draws that job on a timeline: past runs by how they ended, next runs as rings.
What you will learn
The hour that moved
- The 02:00 that moved: A schedule is written in local time. The same crontab line fires at a different UTC instant when the time zone changes.
- Whose 02:00 is it?
- One machine, three clocks: Three clocks: the system clock counts UTC, the RTC keeps time while the power is off, and the time zone is the lens both are shown through.
Borrowed time
- Borrowed time: NTP: A server does not keep time, it borrows it. NTP disciplines the local clock against a hierarchy of servers, and the offset says how far off you are.
- chrony keeps the line: chrony follows one system peer and keeps the rest as backups. Tracking says how far off you are; sources says who told you.
- One timeline for every machine: Logs from two machines share one timeline only if both clocks agree. Five minutes of skew can put the cause after the effect.
Five minutes fast
- Break it: five minutes fast
- Step or slew?: chrony slews small errors so time stays continuous, and steps large ones. Never hand-set a clock that NTP is managing.
- Fix the sync, not the clock: When the time is wrong, repair the synchronization, not the display. A clock that keeps drifting has a cause: battery, hypervisor or a blocked NTP port.
A signed identity
- The Friday problem: A certificate binds a name to a public key for a fixed window. Outside notBefore and notAfter it is not a certificate, it is history.
- An identity card, signed: The subject says who the certificate is for; the issuer says who vouches for it. When they differ, follow the chain upward.
- Who signed it: self or CA?: Trust is a chain: the leaf names the shop, each issuer vouches for the one below, and the root is already in your trust store.
- Ask with a CSR: A CSR asks a CA to sign; the private key never leaves the machine. Self-signed vouches for itself, so every client must trust it by hand.
- The till's self-signed cert
Friday midnight
- Break it: Friday 00:30, expired
- A check that pages before Friday: Expiry is absolute and silent: monitor notAfter in days-left, and alert while renewal is still boring.
- Drill: read the expiry date
- Drill: ask chrony for the offset
Recap & playground
- Cheat sheet
- Playground