diff --git a/lib/pharos/logging.rb b/lib/pharos/logging.rb
index 796881d8e..5b512930c 100644
--- a/lib/pharos/logging.rb
+++ b/lib/pharos/logging.rb
@@ -17,7 +17,11 @@ def self.format_exception(exc, severity = "ERROR")
         backtrace = "\n    #{exc.backtrace.join("\n    ")}"
       end
 
-      "Error: #{exc.message.strip}#{backtrace}"
+      if exc.is_a?(Excon::Errors::CertificateError)
+        "Error: #{exc.message.lines.first[/(.+?\))/, 1]}#{backtrace}"
+      else
+        "Error: #{exc.message.strip}#{backtrace}"
+      end
     end
 
     def self.log_level
diff --git a/lib/pharos/phases/validate_host.rb b/lib/pharos/phases/validate_host.rb
index ccaf2acf2..282853b5c 100644
--- a/lib/pharos/phases/validate_host.rb
+++ b/lib/pharos/phases/validate_host.rb
@@ -6,6 +6,8 @@ class ValidateHost < Pharos::Phase
       title "Validate hosts"
 
       def call
+        logger.info { "Validating localhost and host clock sync ..." }
+        check_clock
         logger.info { "Validating current role matches ..." }
         check_role
         logger.info { "Validating distro and version ..." }
@@ -22,6 +24,15 @@ def call
         validate_peer_address
       end
 
+      def check_clock
+        local_time = Time.now.to_i
+        server_time = transport.exec!('date +%s').to_i
+
+        return if (server_time - local_time).abs < 60
+
+        logger.warn "Clock drift #{(server_time - local_time).abs} seconds - certificate validation may fail"
+      end
+
       def check_distro_version
         return if host_configurer