SAML AuthInstant is after server time

[Vignesh, Vanna G.]

We are having an issue with one of the SPs. AuthInstant is a second before the validity time period. So, the SP is receiving the expired certificate error. How to match them?
We even tried server ntp restart.
<saml2:Conditions NotBefore="2014-11-19T01:38:01.167Z" NotOnOrAfter="2014-11-19T01:43:01.167Z">
<saml2:AuthnStatement AuthnInstant="2014-11-19T01:38:00.620Z"

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141119/9e006b6a/attachment.html