htpdate Can Query Time Through an HTTP Proxy

ntpdate speaks NTP over UDP. An ordinary HTTP CONNECT tunnel carries a TCP stream, so configuring an HTTP proxy does not give ntpdate that UDP route.

When only HTTP access is available, htpdate is a separate tool that estimates time from web-server response timestamps. With it already available, a query-only invocation is:

htpdate -q -P proxy.example:8080 www.example.org

Choose a permitted proxy and a reference server whose clock is suitable for the job. Public candidates for the proxy address are in the HTTP proxy list; that list supplies no trusted time reference. -P selects the intermediary; -q queries without changing the clock. The client also supports multiple reference URLs.

htpdate accounts for issues that a shell pipeline copying one HTTP Date header does not, including multiple sources and filtering inconsistent results. It still relies on the reference servers, response handling and network timing.

A cached response can contain an older Date value. A bare HTTP timestamp is also not authenticated time. Keep the trust and accuracy requirements with the deployment decision rather than treating any reachable web page as a replacement for the network's time service.

If the organization provides an internal NTP service, using that reachable service is another route. Querying time and authorizing a daemon to adjust the system clock are separate operations.