diff --git a/tms/asset-manager/internal/ca/ca.go b/tms/asset-manager/internal/ca/ca.go
index 850b87bfcb873c127da9c973b866c115f495800f..36bf526b2d486c1fbfc29a2d91c51705c112fc4e 100644
--- a/tms/asset-manager/internal/ca/ca.go
+++ b/tms/asset-manager/internal/ca/ca.go
@@ -30,6 +30,8 @@ import (
 	"time"
 )
 
+const certificateClockSkew = 5 * time.Minute
+
 // Manager 管理内置的证书颁发机构（CA）。
 type Manager struct {
 	caCert       *x509.Certificate
@@ -87,7 +89,7 @@ func (m *Manager) SignCert(agentID uint64) (
 	}
 
 	now := time.Now().UTC()
-	notBefore = now
+	notBefore = now.Add(-certificateClockSkew)
 	notAfter = now.Add(time.Duration(m.validityDays) * 24 * time.Hour)
 	template := &x509.Certificate{
 		SerialNumber: serialNumber,
diff --git a/tms/asset-manager/internal/ca/ca_test.go b/tms/asset-manager/internal/ca/ca_test.go
index ff33b094ca158700dda456763753819c6349c73f..6fe2728d7d3ebbff6ddd6466f4fa3cdbc4f5c370 100644
--- a/tms/asset-manager/internal/ca/ca_test.go
+++ b/tms/asset-manager/internal/ca/ca_test.go
@@ -304,3 +304,25 @@ func TestSignCert(t *testing.T) {
 		t.Errorf("cert verification failed: %v", err)
 	}
 }
+
+func TestSignCertBackdatesNotBeforeForClockSkew(t *testing.T) {
+	dir := t.TempDir()
+	m, err := New(filepath.Join(dir, "ca.crt"), filepath.Join(dir, "ca.key"), 365)
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+
+	started := time.Now().UTC()
+	_, _, _, _, notBefore, _, err := m.SignCert(12345)
+	finished := time.Now().UTC()
+	if err != nil {
+		t.Fatalf("SignCert: %v", err)
+	}
+
+	if notBefore.After(started.Add(-5 * time.Minute)) {
+		t.Fatalf("notBefore = %v, want no later than %v", notBefore, started.Add(-5*time.Minute))
+	}
+	if notBefore.Before(finished.Add(-5*time.Minute - time.Second)) {
+		t.Fatalf("notBefore = %v, want close to five minutes before signing", notBefore)
+	}
+}