openssl-ts
handles RFC 3161 Time Stamping Authority operations
TLDR
SYNOPSIS
openssl ts command [options]
DESCRIPTION
openssl ts handles RFC 3161 Time Stamping Authority (TSA) operations. It creates timestamp requests (TSQ), generates responses (TSR) as a TSA server, and verifies existing TSRs. It is primarily used to prove that data existed in a specific form at a specific time — document notarization, code-signing countersignatures, and archival integrity.The three operating modes are mutually exclusive:- -query — client-side request creation.- -reply — server-side response creation (requires a signer certificate and key).- -verify — client-side verification of a response against the original data (or digest) and a trust store.
PARAMETERS
-query
Create timestamp request.-reply
Create timestamp response.-verify
Verify timestamp response.-data file
Data file to timestamp.-in file
Input file.-out file
Output file.-text
Print in human-readable form.-config FILE
Specify a custom `openssl.cnf`.-queryfile FILE
Path to an existing TSQ when generating a reply (-reply) or during verification (-verify).-digest HEX
Provide a precomputed digest instead of hashing `-data`.-no_nonce
Do not include a nonce in the request.-cert
Request that the TSA include its certificate in the reply.-signer FILE
Signing certificate (PEM) used by -reply.-inkey FILE|URI
Private key matching `-signer`.-chain FILE
Extra certificates to include in the response chain.-tspolicy OID
Policy OID asserted by the TSA.-untrusted FILES
Untrusted intermediates for chain building during -verify.-CAfile FILE, -CApath DIR, -CAstore URI
Trust anchors used during -verify.-attime TIMESTAMP
Verify as if at a specific time.-token_in, -token_out
Read/write a bare PKCS#7 token rather than a full TimeStampResp.
INSTALL
CAVEATS
Requires that the TSA certificate chains to a CA in the supplied trust store. Using -no_nonce makes the response replayable — avoid unless the protocol you are integrating with mandates it. In the OpenSSL 3 series this command is also exposed as `openssl-ts(1ssl)` in the manual.
