# Self-Healing CI: Recovering Clock-Skew TLS / Certificate Failures

> A "certificate not yet valid" TLS error is often clock skew on the runner, not a bad cert. See the manual fix and how self-healing CI corrects and retries.

Source: https://latchkey.dev/learn/self-healing-ci/self-heal-clock-skew-tls  
Updated: 2026-06-25

A certificate that looks "not yet valid" or "expired" when it is clearly fine is usually the runner’s clock being wrong - fix the time, and TLS succeeds.

## What makes a failure safely retryable

Automatic retry is only correct for failures that are genuinely transient. Retrying a deterministic failure wastes minutes and hides a real defect, so the classification matters more than the retry mechanism.

- Safe to retry: network timeouts, registry 5xx, transient DNS failures, a service container that was not ready, a spot instance reclaimed mid-run.
- Not safe to retry: assertion failures, compile errors, lint violations, anything that fails identically on every attempt.
- Ambiguous, and worth investigating rather than retrying: out-of-memory kills, disk exhaustion, and flaky tests. These repeat under load and a retry only hides the trend.
- Always record that a retry happened. A pipeline that silently retries is a pipeline whose real failure rate you do not know.

## FAQ

### How do I know it is clock skew and not a real expired certificate?

Compare the runner’s `date -u` output to a trusted time source and read the error’s "current time" against the cert’s validity window. If the runner’s clock is wrong, a perfectly valid cert looks expired or not-yet-valid - correcting the time resolves it, which is exactly what self-healing does automatically.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt