When NTP is filtered: keeping time roughly right over HTTPS

One box kept reporting System clock synchronized: no. chrony started fine, but every source in chronyc sources showed ?.

It was not configuration: changing pools, adding iburst, loosening maxdistance — nothing helped. nc -u -v to port 123 got no reply, and a capture showed outbound packets with nothing coming back. The provider filters UDP 123 — not rare on cheap hosts whose default security group allows only TCP.

You still need the clock roughly right, or TLS handshakes fail:

curl -sI https://www.cloudflare.com | grep -i '^date:'
curl -sI https://www.google.com    | grep -i '^date:'

Parse both Date headers, average the two offsets, and only step the clock past five seconds so it does not oscillate. Wrap it in a oneshot service with an hourly timer.

Be honest about the accuracy: HTTP dates have one-second resolution and ignore round-trip time, so the real error is a few hundred milliseconds to a couple of seconds. Fine for certificates, not for TOTP.