# Diag: intake TLS failures from clock skew

**Symptom (exact):** forwarder log shows TLS/certificate errors reaching the intake, while DNS and TCP connect fine. Often on fresh VMs, containers without time sync, or after a hypervisor pause.

**Likely causes:** (a) system clock minutes/hours off, (b) NTP not running or blocked (UDP 123 egress), (c) timezone confusion masking the real offset (always compare UTC).

**Confirm:**

1. `date -u` on the host vs real UTC. More than a few minutes off is the diagnosis.
2. `timedatectl` / `ntpq -p`: is NTP running and synced? Unsynced with unreachable peers means UDP 123 is blocked.
3. `openssl s_client` to the intake endpoint: certificate errors that vanish when you mentally shift the clock confirm it.

**Fix:** enable and start NTP/chrony, open UDP 123 egress if blocked, wait for sync. Do not set the clock by hand as a permanent fix; it will drift again.

**Verify:** `date -u` correct, forwarder accepts payloads, host appears in Infrastructure. Add clock sync to your provisioning checklist: every fresh image should sync time before the agent starts.