Chronyd in SLES12-SP5 does not have NTS enabled

This document (000021467) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12 SP5

Situation

The chrony package in SLES12-SP5 does not have the NTS (Network Time Security) feature enabled.

As confirmed with the output below "-NTS":

chronyd -v
chronyd (chrony) version 4.1 (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS -NTS +SECHASH +IPV6 -DEBUG)

Cause

It is intentional that chrony in SLES12-SP5 does not have the NTS feature enabled, due to the reason that the NTS feature in chrony requires TLS1.3.
Since chrony is compiled against the gnutls version in SLES12-SP5 and the gnutls in SLES12-SP5 does not support TLS1.3, thus the reason the NTS feature is not available in SLES12-SP5.

Chrony requires gnutls that supports TLS1.3 or above to enable the NTS feature.

Additional Information

The chrony NTS feature was first enabled in SLES15-SP4 (and above) per the release notes:
https://www.suse.com/releasenotes/x86_64/SUSE-SLES/15-SP4/index.html#jsc-SLE-17334

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.