Getting started

Use OpenSSL and curl to timestamp a file from your workstation. The commands below use the free endpoint. For subscriber access, use the endpoint and authentication configuration supplied during onboarding.

1. Choose an endpoint

CNX's TSA has two kinds of endpoint — see Endpoints for the full comparison:

• free.tsa.cnx.net.kh — self-service, no registration. Use this to evaluate the service or for informal, non-contractual use.
• A subscriber endpoint (<your-org>.tsa.cnx.net.kh) — authenticated, keeps a retained history of issued tokens with CNX acting as witness of record. Provisioning requires CNX to bind your authentication method — contact noc@cnx.net.kh to set one up.

2. Create a request

A timestamp request sends a hash of your data, not the data itself. This command hashes report.pdf with SHA-256 and writes an RFC 3161 request:

openssl ts -query -sha256 -data report.pdf -cert -out report.pdf.tsq

The request includes a nonce and asks for the signing certificate. See the OpenSSL timestamp command for these options.

3. Send the request

curl --fail --silent --show-error -H "Content-Type: application/timestamp-query" --data-binary @report.pdf.tsq --output report.pdf.tsr https://free.tsa.cnx.net.kh/

Inspect the response:

openssl ts -reply -in report.pdf.tsr -text

Confirm that the status indicates a granted request. An HTTP success alone does not establish successful timestamp issuance.

4. Verify and retain the evidence

Follow Verifying a timestamp to check the response against your data and an independently pinned trust anchor. Retain report.pdf, report.pdf.tsq, and report.pdf.tsr together. The original file must remain byte-for-byte unchanged for later verification.

For recurring jobs, continue with Attesting files and logs. For signing-tool integration, use Embedding timestamps in signatures.