Hi ! Does the pool iiiiin common have NTS support ? Or do you plan separate pools for this ? Ciao Gerd

There were some discussion in the past, but no progress until now. [image] Proper cn in certificate for use with NTS Server operators I’m tinkering with NTS on 188.166.95.178 and 193.175.73.151 – NTS seems to be working, but which cn (in the x.509 Certificate) should pool …

Hi ! Ok… im trying to be prepared… BTW: must the cert point to host/domain name (cname) or to server name or to Ip address ? Ciao Gerd

Server names work fine. I haven’t tested with an IP address in the certificate. Not all CA’s support that, so it can be challenging to obtain certificates with an IP address.

I don’t recall if NTS as it’s specified today supports this, but I think if we supported NTS the pool system would setup individual server names for each server (“server-5a52x.pool-servers.ntppool.dev”) and then having the certs be for those names (either with a public CA like letsencrypt or a small…

Here is an old discussion re: srv records and NTS. BTW I think most of you are nuts, and SRV records would be the only reasonable way to get NTS into the pool. Here is a ntpsec-only client-side bolt-on for an NTS pool using SRV records.

[image] ask: I don’t recall if NTS as it’s specified today supports this RFC8915 doesn’t have this, but there once was an attempt to do it: NTS for the NTP pool Network Time Security authenticates NTP servers. This document outlines an architecture that uses ACME and SRV records…

The NTS for the NTP pool draft has: Clients MAY periodically resolve the pool associated domain names to confirm the server is still trusted by the pool. ¶ That would turn over the pool server with most periodic resolutions if the NTS pool names were resolved similarly to today. Not a problem if…

[image] Jamesb192: Here is an old discussion re: srv records and NTS. BTW I think most of you are nuts, and SRV records would be the only reasonable way to get NTS into the pool. Here is a ntpsec-only client-side bolt-on for an NTS pool using SRV records. There is no need to have ‘secure-ti…

[image] ask: I don’t recall if NTS as it’s specified today supports this, but I think if we supported NTS the pool system would setup individual server names for each server (“server-5a52x.pool-servers.ntppool.dev”) and then having the certs be for those names (either with a public CA like letse…

[image] ebahapo: the certificate might also have to include the wildcard domain as an alternative, or *.pool.ntp.org Yes, but this may not work with older versions of NTPsec: [image] NTS does not work with wildcard certificates (#729) · Issues · NTPsec / ntpsec... When an NTS-ser…

NTS Support in the pools

Server operators

alica July 14, 2023, 8:40am 2

There were some discussion in the past, but no progress until now.

Topic		Replies	Views
Proper cn in certificate for use with NTS Server operators	6	1441	October 27, 2020
An idea about NTS in the pool Pool Development	0	707	December 8, 2023
NTS Pool experiments	28	714	March 24, 2026
DNS SRV records for NTP and NTS Pool Development dns	29	9081	May 23, 2026
Here is live data from my NTP-NTS server Server operators	60	928	November 13, 2025

NTS Support in the pools

Related topics