SAML: “not yet valid” – clock skew on NotBefore

What the message looks like

Could not validate timestamp: not yet valid. Check system clock.

Common causes

• Server clock without NTP runs fast or slow, typical for VMs after a snapshot restore.
• The NTP service runs but cannot reach a time server (firewall on UDP 123).
• The IdP server (e.g. ADFS) has the wrong time itself.
• Wrong time zone confused with wrong time – SAML always uses UTC.
• Very short assertion lifetime at the IdP combined with a slow redirect.

Check

1. Show time and NTP status
   timedatectl statusCopy
2. Show the offset to the time server
   chronyc tracking 2>/dev/null || ntpq -pCopy
3. Compare UTC time of SP and IdP directly
   date -u; ssh idp.example.com date -uCopy

Fix

• Enable NTP: timedatectl set-ntp true, or install and start chrony.
• Allow outbound UDP 123 to the time servers.
• Check the time on the IdP as well; with ADFS set NotBeforeSkew to 1–2 minutes if needed.
• Do not raise tolerances to many minutes – that weakens protection against replayed assertions.
• On VMs make sure time is synced via the hypervisor or NTP.

FAQ

How much skew is allowed?

Most libraries tolerate a few seconds up to about 3 minutes. With working NTP the offset stays below one second.

Why does it only happen sometimes?

Because the clock drifts slowly. Right after a correction it works, hours later it does not. Only a running NTP service fixes it for good.