Time source and accuracy

The generation time in an RFC 3161 token comes from the TSA signer's system clock. CNX's TSA signer clocks use an on-premises, UTC-traceable reference from GNSS-disciplined atomic-clock grandmasters. Hardware-timestamped PTP carries that reference to the hypervisors. Each TSA virtual machine receives the hypervisor's precision hardware clock through ptp_kvm, and chrony disciplines its system clock against it.

The reference chain is:

GNSS -> atomic-clock grandmasters -> hardware-timestamped PTP
     -> hypervisor clock -> VM precision hardware clock -> TSA system clock
     -> token generation time

Monitoring covers grandmaster reachability, PTP synchronization state, offset and jitter, hypervisor and VM clock synchronization, and chrony's reported clock-error components.

Accuracy and interpretation

The number of fractional digits shown in a token's generation time is its representation and does not, by itself, establish clock accuracy. The Timestamp Policy is the authoritative source for the accuracy commitment applicable to a CNX timestamp token. Signature and policy verification confirms that the TSA issued the token over the submitted message imprint; it is not an independent measurement of the signer's clock offset at that instant.