Embedding timestamps in signatures

Code- and document-signing tools that support RFC 3161 request a timestamp as part of signing and embed the token inside the signature itself, rather than producing a separate .tsr file. The result is a signature that stays verifiable after the signing certificate expires or is revoked, because the embedded timestamp proves the signature was made while the certificate was still valid.

Windows executables

signtool sign /tr https://free.tsa.cnx.net.kh/ /td sha256 /fd sha256 myapp.exe

/tr sets the timestamp endpoint, /td the digest algorithm for the timestamp itself, /fd the digest algorithm for the file signature.

Java archives

jarsigner -tsa https://free.tsa.cnx.net.kh/ -keystore keystore.jks myapp.jar signing-alias

PDF documents

Adobe Acrobat Pro, iText 7, and PyHanko all support RFC 3161 timestamping as part of the signing step directly in their signing API or UI — point the timestamp server setting at a TSA endpoint; no separate file to manage.

Use a subscriber endpoint (see Endpoints) rather than the free one for signatures that need to remain verifiable long-term — the free endpoint's tokens aren't retained past CNX's short-term operational window.