Request and token format
Requests and responses follow RFC 3161 (Time-Stamp Protocol) directly — no CNX-specific extensions.
Request
A timestamp request carries a hash of the data being stamped, not the data itself:
openssl ts -query -sha256 -data report.pdf -no_nonce -out report.tsqAccepted message-digest algorithms: SHA-256 (required), SHA-384, SHA-512.
Token contents
A successful response is a signed token containing:
| Field | Meaning |
|---|---|
messageImprint | The hash algorithm and digest from the request |
genTime | The time the token was generated |
serialNumber | Unique serial for this token |
| Policy OID | 1.3.6.1.4.1.66148.1.2.1 — identifies the Timestamp Policy version this token was issued under |
| Signature | Over the above fields, by the signing certificate described below |
The Policy OID identifies the policy version in effect at issuance, not the current one — the Timestamp Policy is versioned, and an older token stays governed by the policy version it names even after the policy is amended. Check the archived versions listed at tsa.cnx.net.kh/policy.html if the OID in a token doesn't match the current one.
Signing certificate
- Algorithm: ECDSA P-256 with SHA-256, per NIST FIPS 186-4.
- Extended Key Usage:
id-kp-timeStamping(OID1.3.6.1.5.5.7.3.8), marked critical and exclusive — the certificate is valid for timestamping only.
The full chain (signer → TSA intermediate → root CA) travels inside every token; see The trust anchor for how to verify it without trusting the chain as delivered.