Endpoints
| Endpoint | Use |
|---|---|
https://free.tsa.cnx.net.kh/ | Free service. No registration or account required. Rate limits apply. |
https://example-org.tsa.cnx.net.kh/ | Subscriber endpoint, one per customer. Requires authentication. History of issued tokens is retained, with CNX acting as witness of record. Provisioned by CNX — contact noc@cnx.net.kh to set up access. |
The subscriber endpoint's hostname carries the customer's own name in place
of example-org. It's guarded by either web authentication or mTLS against
a CA the customer supplies — CNX validates client certificates issued by
that CA rather than issuing them itself. Binding that CA (or setting up web
authentication) is something CNX has to do on its own systems, which is why
provisioning goes through noc@cnx.net.kh rather than being self-service
like the free endpoint.
Both endpoints accept standard RFC 3161 HTTP timestamp requests over POST — see Request and token format. Every response embeds the full signing chain (signer → TSA intermediate → root CA), so verification never requires contacting CNX; see Verifying a timestamp.
Governing SLA, log retention, and liability terms for each endpoint are defined in the Timestamp Policy — that document is versioned and amended independently of this site, so it's the source to check rather than a copy of its terms.