A method for synchronizing secure clocks in a system without using any external clock, a system configured to perform the method, and a computer medium storing system code. Each secure clock is adjustable subject to a set of predetermined adjustment constraints. The intersection of the adjustment constraints of all the clocks is a limit intersection. The clocks may be synchronized to an average adjusted time of the secure clocks (if the average adjusted time is within the limit intersection) or to a substitute average adjusted time within the limit intersection if the average adjusted time is outside the limit intersection. Synchronization can occur in response to a request to adjust at least one of the clocks by a proposed clock adjustment value or to synchronize at least one of them without otherwise adjusting them.