{"record":{"id":"fb6f9929cc66a9e6","repo":"commaai/openpilot","slug":"system-time-is-not-set-tls-certificate-validation","errorCode":null,"errorMessage":"System time is not set; TLS certificate validation requires a valid clock","messagePattern":"System time is not set; TLS certificate validation requires a valid clock","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"openpilot/common/esim/lpa.py","lineNumber":640,"sourceCode":"  return base64_trim(data[key])\n\n\ndef _cancel_session_safe(client: AtClient, smdp: str, tx_id: str, session: requests.Session) -> None:\n  b64_cancel = \"\"\n  try:\n    b64_cancel = cancel_session(client, b64d(tx_id))\n  except Exception:\n    pass\n  try:\n    es9p_request(smdp, \"cancelSession\", {\"transactionId\": tx_id, \"cancelSessionResponse\": b64_cancel}, \"CancelSession\", session=session)\n  except Exception:\n    pass\n\n\ndef download_profile(client: AtClient, activation_code: str) -> str:\n  \"\"\"Download and install an eSIM profile. Returns the ICCID of the installed profile.\"\"\"\n  if not system_time_valid():\n    raise RuntimeError(\"System time is not set; TLS certificate validation requires a valid clock\")\n  smdp, matching_id = parse_lpa_activation_code(activation_code)\n  challenge, euicc_info = get_challenge_and_info(client)\n  session = requests.Session()\n  tx_id = None\n\n  try:\n    # step 1: initiate authentication\n    auth = es9p_request(smdp, \"initiateAuthentication\", {\n      \"smdpAddress\": smdp, \"euiccChallenge\": b64e(challenge),\n      \"euiccInfo1\": b64e(euicc_info), \"matchingId\": matching_id,\n    }, \"Authentication\", session=session)\n    tx_id = _b64_field(auth, \"transactionId\")\n\n    # step 2: authenticate server\n    b64_auth = authenticate_server(client,\n      _b64_field(auth, \"serverSigned1\"), _b64_field(auth, \"serverSignature1\"),\n      _b64_field(auth, \"euiccCiPKIdToBeUsed\"), _b64_field(auth, \"serverCertificate\"),\n      matching_id)","sourceCodeStart":622,"sourceCodeEnd":658,"githubUrl":"https://github.com/commaai/openpilot/blob/516ec1e68203439a73f340f1d0b3b91eabc626ee/openpilot/common/esim/lpa.py#L622-L658","documentation":"download_profile() refuses to start when system_time_valid() is False, because TLS certificate validation against the SM-DP+ server requires a correct wall clock. Without valid time, cert expiry checks are meaningless and HTTPS would either fail or need to be insecurely disabled.","triggerScenarios":"Calling download_profile() on a device whose clock is unset — e.g. right after boot before GPS or NTP time sync has set the system time.","commonSituations":"Embedded device with no RTC battery boots before GNSS fix; time sync daemon not yet run; VM/container with unsynced clock.","solutions":["Wait for the system time source (GPS/NTP) to set the clock before calling download_profile","Ensure the time-sync service runs before eSIM provisioning in startup ordering","Manually set a roughly correct time if a trusted source is unavailable and re-run"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"from openpilot.common.esim.lpa import system_time_valid\n\ndef can_download() -> bool:\n    return system_time_valid()","typeGuard":null,"tryCatchPattern":"try:\n    download_profile(client, qr)\nexcept RuntimeError as e:\n    if \"System time is not set\" in str(e):\n        wait_for_time_sync()\n        download_profile(client, qr)","preventionTips":["Order startup so time sync completes before eSIM provisioning","Gate eSIM operations on system_time_valid()"],"tags":["esim","time-sync","tls","lpa"],"backgroundTag":null,"analyzedSha":"516ec1e68203439a73f340f1d0b3b91eabc626ee","analyzedAt":"2026-08-15T00:17:37.461Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}