use TLSDATE_EXTRA_OPTIONS="--http" to instruct tlsdate to extract time from http headers by default instead from TLS, because time from TLS is unreliable as per github.com/ioerror/tlsdate/issues/151