# Self-Healing CI: Recovering a Clock-Skew TLS Validation Failure

> A TLS validation failure caused by a skewed runner clock is a time problem, not a bad certificate. See the manual fix and how self-healing CI corrects the time and retries.

Source: https://latchkey.dev/learn/self-healing-ci/self-healing-clock-skew-tls-validation  
Updated: 2026-06-26

When TLS validation rejects a perfectly good certificate, suspect the runner’s clock -- a skewed time makes a valid cert look outside its validity window, and a time sync fixes it.

## What makes a failure safely retryable

Automatic retry is only correct for failures that are genuinely transient. Retrying a deterministic failure wastes minutes and hides a real defect, so the classification matters more than the retry mechanism.

- Safe to retry: network timeouts, registry 5xx, transient DNS failures, a service container that was not ready, a spot instance reclaimed mid-run.
- Not safe to retry: assertion failures, compile errors, lint violations, anything that fails identically on every attempt.
- Ambiguous, and worth investigating rather than retrying: out-of-memory kills, disk exhaustion, and flaky tests. These repeat under load and a retry only hides the trend.
- Always record that a retry happened. A pipeline that silently retries is a pipeline whose real failure rate you do not know.

## FAQ

### What causes Self-Healing CI: recovering a Clock-Skew TLS validation failure?

A TLS connection fails validation against a certificate that is actually valid, because the runner’s clock is skewed -- so the cert appears to fall outside its validity window. The certificate and endpoint are fine; the system time is wrong.

### How do I fix Self-Healing CI: recovering a Clock-Skew TLS validation failure manually?

[object Object]

### Can Self-Healing CI: recovering a Clock-Skew TLS validation failure be fixed automatically?

A clock-skew validation failure has a recognizable signature -- a validity-window error against a known-good cert -- and a well-defined remedy: correct the time and retry. A self-healing CI pipeline detects the skew-driven failure, corrects the runner’s clock, retries the step, and only escalates if the certificate is genuinely outside

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt