Embedding timestamps in signatures

Code- and document-signing tools that support RFC 3161 request a timestamp as part of signing and embed the token inside the signature itself, rather than producing a separate .tsr file. The timestamp provides evidence of when the signature existed. Long-term validation also depends on the verifier's trust, certificate-status evidence, and applicable policy.

Choose your endpoint first. The examples below use the free endpoint; subscriber tools need the assigned endpoint and support for its configured authentication method.

Windows executables

signtool sign /tr https://free.tsa.cnx.net.kh/ /td sha256 /fd sha256 myapp.exe

/tr sets the timestamp endpoint, /td the digest algorithm for the timestamp itself, /fd the digest algorithm for the file signature.

Java archives

jarsigner -tsa https://free.tsa.cnx.net.kh/ -keystore keystore.jks myapp.jar signing-alias

PDF documents

Adobe Acrobat Pro, iText 7, and PyHanko all support RFC 3161 timestamping as part of the signing step directly in their signing API or UI — point the timestamp server setting at a TSA endpoint; no separate file to manage.

Verify the resulting signature and embedded timestamp with the signing tool's verification workflow. Retain the signed artifact and the trust and validation material required by your retention policy. Subscriber issuance history provides CNX-held records; retain your own signed artifacts for both endpoint types. See What a timestamp proves for how to interpret the evidence.