Figured it out…
- After setting passbolt up I didn’t force SSL in passbolt.php, but had the time set. It didn’t work.
- After forcing SSL, by then the time drifted, so it still didn’t work. I’ve forced a ntpdate and MFA is working now!
I’ve set a daily “ntpdate time.google.com” in cron so it should be all good now.
Thanks for help clayton and garret!