Accurate time matters more than it seems: TLS certificates, two-factor codes and Kerberos all fail when the clock is off by minutes. If certificate errors appear on every site, check that UDP 123 isn't blocked and that automatic time is on. You can check the offset with sntp time.apple.com in Terminal.
Facts
- Port
- 123
- Protocols
- UDP
- Service
- NTP
What uses port 123
Time synchronisation: devices ask NTP servers for the current time over UDP 123.
On a Mac
macOS syncs its clock with time.apple.com over UDP 123, through the timed daemon, when “Set time and date automatically” is on. If 123 is blocked, the clock slowly drifts, which can break HTTPS certificate checks.
sudo lsof -nP -iUDP:123Security
Misconfigured public NTP servers have been abused for amplification attacks. Clients just need outbound UDP 123.
Frequently asked questions
Is NTP TCP or UDP?
NTP uses UDP port 123.
What time server does a Mac use?
time.apple.com by default, set in System Settings › General › Date & Time. You can choose another server there.
How do I check my Mac's clock offset?
Run sntp time.apple.com in Terminal. It prints the difference between your clock and the server.