TSA

CNX's Time Stamping Authority issues RFC 3161 timestamp tokens for file and signature hashes. You retain the original data and the response, then verify the hash, signing chain, and timestamp policy when you need the evidence.

Start with Getting started to choose an endpoint and request your first timestamp. Continue with Verifying a timestamp before using the same workflow for files and logs or code and document signatures.

The free endpoint is available without registration. Subscriber endpoints provide authenticated access and retained issuance history. Time source and accuracy explains the GNSS-disciplined atomic-clock reference and points to the Timestamp Policy for the applicable accuracy commitment.

Start and connect

• Getting started

  Choose an endpoint, request a timestamp, and retain the files needed to verify it.

• Endpoints

  The free endpoint and the per-customer subscriber endpoint, and what each is for.

• Request and token format

  RFC 3161 message contents and the accepted hash and signing algorithms.

Verify and trust

• Verifying a timestamp

  Independently checking a token's chain, policy, and signature against the original data.

• The trust anchor

  How to discover and pin CNX's TSA root CA without trusting the chain a token delivers.

Files and signatures

• Attesting files and logs

  Stamping backups, release artifacts, and logs as standalone evidence alongside the file.

• Embedding timestamps in signatures

  Requesting a timestamp as part of code- and document-signing, instead of as a separate token file.

Time and evidence

• What a timestamp proves

  What an RFC 3161 token attests to, and why verifying one never requires contacting CNX.

• Time source and accuracy

  The UTC-traceable clock chain behind TSA token generation times and where the applicable accuracy commitment is defined.