How do I resolve requestTimeTooSkewed when ZCenter connects to ZSphere?

Issue/Introduction

This article describes how to troubleshoot HTTP 403 and requestTimeTooSkewed returned by ZSphere when ZCenter adds, tests, or reconnects a ZSphere cloud account. The error means that ZSphere determined that the difference between the REST request Date header and the current management node time exceeded the allowed range. The system clocks might be unsynchronized, or ZCenter and ZSphere might use different time zones while the time-zone validation switch uses a comparison method unsuitable for the environment.

Symptoms

• Adding a ZSphere cloud environment, testing a cloud account connection, or reconnecting an account in ZCenter fails.
• The page might display ZSphere account validation failed, with requestTimeTooSkewed in the cause.
• ZSphere returns HTTP 403 before reaching the normal account, license, or resource query flow.
• The cloud account status might remain or change to off, preventing subsequent resource synchronization.
• ZCenter and ZSphere might display local times several hours apart, for example, when one uses UTC and the other uses UTC+8.

Environment

• Product: ZCenter
• Version: 5.1.0
• Integrated platform: ZSphere 5.1.x and versions with the same time-zone validation mechanism
• Component: ZCenter ZSphere connection component, ZSphere REST API, and ZSphere management nodes
• Authentication: AK/SK-signed calls to the ZSphere REST API

Possible causes