openssl-ts

Generate a SHA-512 timestamp request of a specific file and output to file.tsq

$ openssl ts -query -data [path/to/file] -sha512 -out [path/to/file.tsq]

$ openssl ts -reply -in [path/to/file.tsr] -text

$ openssl ts -verify -in [path/to/file.tsr] -queryfile [path/to/file.tsq] -partial_chain -CAfile [path/to/cert.pem]

$ openssl ts -reply -queryfile [path/to/file.tsq] -inkey [path/to/tsakey.pem] -signer tsacert.pem -out [path/to/file.tsr]

openssl ts req [options]
openssl ts resp [options]

-help
    Displays the usage message for the specific subcommand (req or resp).

-in
    Specifies the input file. For req, this is the data to be time-stamped; for resp, it's the timestamp request or response to be processed.

-out
    Specifies the output file where the generated request or response will be written.

-text
    Prints the content of the Time Stamp Request or Response in a human-readable text format.

-rand
    Specifies one or more files to seed the pseudo-random number generator (PRNG) for cryptographic operations.

-writerand
    Writes the PRNG state to the specified file, allowing it to be reloaded later for continued randomness.

-engine
    Specifies a cryptographic engine to be used for hardware acceleration or alternative cryptographic implementations.

-config
    Specifies an alternative configuration file to use instead of the default OpenSSL configuration.

-section
    Specifies a section within the configuration file from which to read additional options and settings.

-no_nonce
    Prevents the generation of a nonce (a unique, random number) in the time stamp request, which is typically included to prevent replay attacks.

-md (for req)
    Specifies the message digest algorithm to be used for hashing the input data (e.g., sha256, sha512).

-mda (for resp)
    Specifies the message digest algorithm to be used for response generation or verification.

-policy
    Specifies the OID (Object Identifier) of the Time Stamp Policy to be requested or verified within the timestamp.

-queryfile (for req)
    Uses an existing Time Stamp Request (TSR) file as input for re-processing or modification, instead of creating a new one from data.

-data (for req)
    Specifies the data file whose hash will be time-stamped. This is an alternative to using -in for raw data.

-digest (for req)
    Provides the hex string of the message digest directly to be time-stamped, bypassing the need to calculate it from a file.

-cert (for req)
    Requests the Time Stamping Authority to include its signing certificate in the Time Stamp Response.

-tsp_section (for req)
    Specifies a section in the configuration file containing options specific to the Time Stamp Protocol request.

-query (for resp)
    Instructs the command to treat the input as a Time Stamp Request and generate a Time Stamp Response, acting as a TSA.

-reply (for resp)
    Instructs the command to treat the input as a Time Stamp Response and display its contents in text form.

-CA (for resp)
    Specifies the CA certificate file to be used for verifying signatures within the time stamp response.

-CApath

The openssl ts command is a powerful subcommand of the OpenSSL cryptographic toolkit, specifically designed for operations related to the Time Stamping Protocol (TSP) as defined in RFC 3161 and RFC 5816. It enables users to create Time Stamp Requests (TSRs) for various data types and to process, verify, or generate Time Stamp Responses (TSRs) from a Time Stamping Authority (TSA). This functionality is vital for providing cryptographic proof that data existed at a specific point in time, thereby ensuring non-repudiation and data integrity for legal and archival purposes. The command supports diverse cryptographic algorithms for hashing and signing, integrates with OpenSSL's configuration file for advanced settings, and can include nonces to prevent replay attacks. It serves as a fundamental tool for digital preservation, long-term document validation, and authenticating electronically signed records.

The openssl ts command functions as a client for creating time stamp requests and for processing/verifying responses, and it can also generate responses from requests when acting as a basic TSA. However, it does not implement the full network communication protocol for a Time Stamping Authority (TSA) server. To interact with a remote TSA, external tools (like curl) are typically used to send the generated request over HTTP/HTTPS and receive the response. Correct setup of trusted CA certificates and the TSA's signing certificate/private key is paramount for reliable time stamping and verification processes. Furthermore, the quality of OpenSSL's random number generator (PRNG) is crucial for the security of nonces and other cryptographic elements; ensure it is properly seeded, especially in production environments.

While openssl ts is adept at generating Time Stamp Requests (TSRs) and parsing Time Stamp Responses (TSRs), it does not act as a full network-enabled TSA server. To obtain a cryptographically valid timestamp, the TSR generated using openssl ts req must typically be sent to a trusted remote TSA server (often via HTTP POST to a designated URL). The signed response received back from the TSA is then processed and verified using openssl ts resp.

Many advanced options, particularly when openssl ts resp is used in -query mode (i.e., acting as a TSA to generate responses), can be configured within the OpenSSL configuration file. This allows for setting default time stamp policies, specifying certificate paths for signers and CAs, and defining other operational parameters, which simplifies command-line invocation for recurring or complex time-stamping tasks.

The Time Stamping Protocol (TSP) functionality has been an integral part of the OpenSSL project for many years, evolving in parallel with the TSP standard itself. TSP is formally defined in RFC 3161 (Time-Stamp Protocol), which succeeded earlier specifications, and was further updated by RFC 5816 to incorporate policy and security requirements. The openssl ts command provides a robust command-line interface for interacting with these PKI standards, enabling developers and administrators to seamlessly integrate time-stamping into their digital workflows and applications. Its development has consistently focused on delivering strong cryptographic operations for time-stamping, adhering to Public Key Infrastructure (PKI) best practices, and ensuring broad interoperability with various Time Stamping Authorities (TSAs) worldwide.

openssl(1), openssl-req(1), openssl-x509(1), openssl-verify(1), openssl-s_server(1), curl(1)