diff --git a/Sanity/sanity-nts-selftest/config.txt b/Sanity/sanity-nts-selftest/config.txt
new file mode 100644
index 0000000..569d62e
--- /dev/null
+++ b/Sanity/sanity-nts-selftest/config.txt
@@ -0,0 +1,7 @@
+cn = "vm-10-0-187-208.hosted.upshift.rdu2.redhat.com"
+dns_name = "vm-10-0-187-208.hosted.upshift.rdu2.redhat.com"
+serial = 001
+activation_date = "2010-01-01 00:00:00 UTC"
+expiration_date = "2040-01-02 00:00:00 UTC"
+signing_key
+encryption_key
diff --git a/Sanity/sanity-nts-selftest/main.fmf b/Sanity/sanity-nts-selftest/main.fmf
new file mode 100644
index 0000000..e6321d9
--- /dev/null
+++ b/Sanity/sanity-nts-selftest/main.fmf
@@ -0,0 +1,25 @@
+summary: 'Test for: NTS sanity self test'
+description: 'nts: Configure and connect to nts server'
+contact: Ondrej Mejzlik <omejzlik@redhat.com>
+test: ./runtest.sh
+framework: beakerlib
+duration: 5m
+enabled: true
+tag:
+  - NoRHEL6
+  - NoRHEL7
+adjust:
+  - enabled: false
+    when: distro < rhel-8
+    continue: false
+  - enabled: false
+    when: distro = rhel-alt-7
+    continue: false
+component:
+  - chrony
+recommend:
+  - chrony
+  - gnutls-utils
+  - net-tools
+extra-nitrate: TC#0617129
+id: 1f3c925d-1ab0-49b3-a25b-466b1a3f8872
diff --git a/Sanity/sanity-nts-selftest/runtest.sh b/Sanity/sanity-nts-selftest/runtest.sh
new file mode 100755
index 0000000..f6307ab
--- /dev/null
+++ b/Sanity/sanity-nts-selftest/runtest.sh
@@ -0,0 +1,92 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/chrony/Sanity/sanity-nts-selftest
+#   Description: Test for NTS self test.
+#   Author: Ondrej Mejzlik <omejzlik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2024 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE=${PACKAGE:-chrony}
+CKEY='/etc/pki/tls/private/server.key'
+CCRT='/etc/pki/tls/private/server.crt'
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE || rlDie "Package $PACKAGE not installed"
+        rlLog "Arch: $(arch), PC name: $(hostname), $(hostname -A) User: $(whoami)"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        TEST_DIR=$(pwd)
+        rlRun "pushd $TmpDir" 0 "Going into tmp directory $TmpDir"
+        rlRun "cp $TEST_DIR/config.txt ." 0 "Copy cert config file"
+        DEFAULT_IF=`route | grep default | awk '{print $8}' | head -n 1` && echo $DEFAULT_IF
+        DEFAULT_IPv4=`ip a l dev $DEFAULT_IF |grep 'inet ' |sed 's/.* inet \([^/]*\).*/\1/'|tr " " "\n"|head -1` && echo $DEFAULT_IPv4  
+        rlLog "IF: $DEFAULT_IF, IP: $DEFAULT_IPv4"
+        echo "ip_address = \"$DEFAULT_IPv4\"" >> config.txt 
+        cat ./config.txt 
+
+        rlRun "certtool --generate-privkey --key-type=ed25519 --outfile server.key" 0 "Generate key"
+        rlRun "certtool --generate-self-signed --load-privkey server.key --template config.txt --outfile server.crt" 0 "Generate certificate"
+        rlRun "mv server.crt server.key /etc/pki/tls/private/" 0 "Move certificates"
+        rlRun "chown root:chrony $CKEY $CCRT" 0 "Change cert ownership"
+        rlRun "chmod ug+r $CKEY $CCRT" 0 "Make certificates readable"
+        rlRun "restorecon -R $CKEY $CCRT" 0 "Fix context"
+        rlRun "cat $CCRT >> /etc/pki/ca-trust/source/anchors/server.crt" 0 "Copy certificate to trusted location"
+        rlRun "update-ca-trust" 0 "Update trusted certs"
+        rlRun "rlFileBackup /etc/chrony.conf" 0 "Back up /etc/chrony.conf"
+        rlRun "echo 'allow' >> /etc/chrony.conf" 0 "Configure chronyd"
+        rlRun "echo 'ntsdumpdir /var/lib/chrony' >> /etc/chrony.conf" 0 "Configure chronyd"
+        rlRun "echo 'local stratum 10' >> /etc/chrony.conf" 0 "Configure chronyd"
+        rlRun "echo \"ntsserverkey $CKEY\" >> /etc/chrony.conf" 0 "Use key for chrony"
+        rlRun "echo \"ntsservercert $CCRT\" >> /etc/chrony.conf" 0 "Use cert for chrony"
+        rlRun "sed -i s/^server/#server/g /etc/chrony.conf" 0 "Disable default chrony source servers"
+        rlRun "sed -i s/^pool/#pool/g /etc/chrony.conf" 0 "Disable default chrony pool servers"
+        rlRun "echo \"server $DEFAULT_IPv4 nts minpoll 0 maxpoll 0\" >> /etc/chrony.conf" 0 "Configure chronyd"
+        rlRun "rm -rf /var/lib/chrony/*.nts" 0 "Remove old nts records"
+        rlRun "rlServiceStart chronyd" 0 "Start chrony"
+        systemctl status chronyd
+    rlPhaseEnd
+
+    rlGetTestState && {
+    rlPhaseStartTest
+        rlRun "sleep 20" 0 "Wait for sync"
+        SHOST=$(hostname | cut -c 1-10)
+        rlRun "chronyc sources | grep \"^\^\?.*${SHOST}.*377\"" 0 "Server is connected"
+        chronyc sources
+        rlRun "chronyc authdata | grep \"${SHOST}.*NTS.*1\"" 0 "NTS key reported"
+        chronyc authdata
+    rlPhaseEnd
+    }
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf $CKEY $CCRT" 0 "Delete used certificates"
+        rlRun "rm -rf /etc/pki/ca-trust/source/anchors/server.crt" 0 "Delete test certificate"
+        rlRun "rlFileRestore" 0 "Restore files"
+        rlRun "update-ca-trust" 0 "Update trusted certs"
+        rlRun "rlServiceRestore chronyd" 0 "Restore chronyd"
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd