We address the problem of how to integrate fault-tolerant internal and external clock synchronization. We propose a new algorithm which provides both external and internal clock synchronization for as long as no more than F reference time servers out of a total of 2F+1 are faulty. When the number of faulty reference time servers exceeds F, the algorithm degrades to a fault-tolerant internal clock synchronization algorithm. We prove that at least 2F+1 reference time servers are necessary for achieving external clock synchronization when up to F reference time servers can suffer arbitrary failures, thus our algorithm provides maximum fault-tolerance. The algorithm is also optimal in another sense: we show that the maximum deviation between reference time and the clocks of nonreference time servers is minimal.