OPENSSL-TS(1ssl) OpenSSL OPENSSL-TS(1ssl) (NAME) openssl-ts - (TSA) (SYNOPSIS) openssl ts -help openssl ts -query [-config configfile] [-data file_to_hash] [-digest digest_bytes] [-digest] [-tspolicy object_id] [-no_nonce] [-cert] [-in request.tsq] [-out request.tsq] [-text] [-rand files] [-writerand file] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] openssl ts -reply [-config configfile] [-section tsa_section] [-queryfile request.tsq] [-passin password_src] [-signer tsa_cert.pem] [-inkey filename|uri] [-digest] [-chain certs_file.pem] [-tspolicy object_id] [-in response.tsr] [-token_in] [-out response.tsr] [-token_out] [-text] [-engine id] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] openssl ts -verify [-data file_to_hash] [-digest digest_bytes] [-queryfile request.tsq] [-in response.tsr] [-token_in] [-untrusted files|uris] [-CAfile file] [-CApath dir] [-CAstore uri] [-allow_proxy_certs] [-attime timestamp] [-no_check_time] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict] [-issuer_checks] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] (DESCRIPTION) () (Time Stamping Authority TSA) RFC 3161 ( TSP) . TSA (PKI) . : 1. TSA TSA . 2. TSA (Timestamp Token) . TSA . 3. TSA . TSA . (PDU) DER TSA . : . RFC 3161 / HTTP TCP . ftp . (OPTIONS) -help . -query (TS query). << >> . -reply (TS reply). << >> . -verify (TS response). << >> . (Timestamp Request generation) -query : -config configfile . <> openssl(1) . -data file_to_hash . -data -digest (stdin) . () -digest digest_bytes (Message Imprint) . ( 1A:F6:01:... 1AF601...) . . () -digest . openssl-dgst(1) . SHA-256 . () -tspolicy object_id TSA . OID OID . TSA . () -no_nonce (Nonce) . . (Replay Attacks) . () -cert TSA . () -in request.tsq DER . . () -out request.tsq . (stdout) . () -text DER . () -rand files, -writerand file <> openssl(1) . (Timestamp Response generation) (TimeStampResp) (ContentInfo) ( ). -reply / . -token_out (TimeStampResp) (ContentInfo) . -config configfile . <> openssl(1) . << >> . -section tsa_section . TSA << >> . () -queryfile request.tsq DER . () -passin password_src TSA . openssl(1) . () -signer tsa_cert.pem TSA PEM. TSA (Extended Key Usage) timeStamping . (Critical) . signer_cert (Override) . () -inkey filename|uri TSA PEM. signer_key . () -digest . signer_digest . ( ) -chain certs_file.pem PEM -cert . . -reply . () -tspolicy object_id TSA . OID . default_policy . () -in response.tsr ( -token_in ) DER . . 'granted' . () -token_in -in DER (ContentInfo) (TimeStampResp). () -out response.tsr . ( -text -token_out ). (stdout) . () -token_out (TimeStampResp) (ContentInfo) . () -text DER . () -engine id <> openssl(1) . . -provider name -provider-path path -provparam [name:]key=value -propquery propq <> openssl(1) provider(7) property(7) . (Timestamp Response verification) -verify . -verify . -data file_to_hash file_to_hash . . -digest -queryfile . () -digest digest_bytes . . -data -queryfile . () -queryfile request.tsq DER. -data -digest . () -in response.tsr DER . () -token_in -in DER (ContentInfo) (TimeStampResp). () -untrusted files|uris TSA . TSA CA . () / . . -CAfile file, -CApath dir, -CAstore uri <> openssl-verification-options(1) . -CAfile -CApath -CAstore . -allow_proxy_certs, -attime, -no_check_time, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict -issuer_checks . <> openssl-verification-options(1) . . (CONFIGURATION FILE OPTIONS) -query -reply . (Syntax) config(5) . -query OID . -reply . . tsa default_tsa -reply . -section . () oid_file (OBJECT IDENTIFIERS) . . () oid_section . = . . () RANDFILE . (: RANDFILE <<>> ). serial . . . () crypto_device OpenSSL . built-in OpenSSL ( chil HSM NCipher). () signer_cert TSA PEM. -signer . () certs PEM . -chain . () signer_key TSA PEM. -inkey . () signer_digest . -digest . ( ) default_policy . -tspolicy . () other_policies TSA . () digests TSA . . () accuracy TSA . secs:1, millisecs:500, microsecs:100. . () clock_precision_digits . . . . () ordering yes TSA . no . () tsa_name (Subject) TSA TSA yes . no . () ess_cert_id_chain SignedData TSA ( RFC 2634 Enhanced Security Services ). no SigningCertificate . yes certs -chain -chain certs . no . () ess_cert_id_alg TSA . sha256 . () (EXAMPLES) OPENSSL_CONF openssl/apps/openssl.cnf . (Timestamp Request) design1.txt SHA-256 : openssl ts -query -data design1.txt -no_nonce \ -out design1.tsq (Message Imprint): openssl ts -query -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \ -no_nonce -out design1.tsq : openssl ts -query -in design1.tsq -text SHA-512 design2.txt ( tsa_policy1 OID ): openssl ts -query -data design2.txt -sha512 \ -tspolicy tsa_policy1 -cert -out design2.tsq (Timestamp Response) TSA timeStamping . (user certificate) : extendedKeyUsage = critical,timeStamping openssl-req(1) openssl-ca(1) openssl-x509(1) . cacert.pem CA tsacert.pem cacert.pem tsakey.pem TSA . : openssl ts -reply -queryfile design1.tsq -inkey tsakey.pem \ -signer tsacert.pem -out design1.tsr : openssl ts -reply -queryfile design1.tsq -out design1.tsr : openssl ts -reply -in design1.tsr -text : openssl ts -reply -queryfile design1.tsq -out design1_token.der -token_out : openssl ts -reply -in design1_token.der -token_in -text -token_out : openssl ts -reply -in design1.tsr -out design1_token.der -token_out 'granted' : openssl ts -reply -in design1_token.der -token_in -out design1.tsr (Timestamp Verification) : openssl ts -verify -queryfile design1.tsq -in design1.tsr \ -CAfile cacert.pem -untrusted tsacert.pem : openssl ts -verify -queryfile design2.tsq -in design2.tsr \ -CAfile cacert.pem : openssl ts -verify -data design2.txt -in design2.tsr \ -CAfile cacert.pem (Message Imprint): openssl ts -verify -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \ -in design2.tsr -CAfile cacert.pem 'test' . (BUGS) o SMTP TSA procmail(1) perl(1) . HTTP . HTTP tsget(1) . TCP/IP . o TSA . openssl(1) . . o FIXME . o . o ( test/testtsa ). (HISTORY) 1.1.1 (CSPRNG) (Seeding) . RANDFILE . . -engine OpenSSL 3.0 . (SEE ALSO) openssl(1), tsget(1), openssl-req(1), openssl-x509(1), openssl-ca(1), openssl-genrsa(1), config(5), ossl_store-file(7) (COPYRIGHT) - OpenSSL. . . (<<>>) . . LICENSE : 3.6.4 2026-08-25 OPENSSL-TS(1ssl)