info > openssl-ts(1)

Not found locally for openssl-ts. Try Google search

📝 NAME

openssl-ts - Time Stamping Authority command

🚀 Quick Reference

Use CaseCommandDescription
🔍 Generate timestamp requestopenssl ts -query -data file -out request.tsqCreate a timestamp request for a data file
📄 Generate timestamp responseopenssl ts -reply -queryfile request.tsq -inkey key.pem -signer cert.pem -out response.tsrCreate a timestamp response from a request
✅ Verify timestamp responseopenssl ts -verify -queryfile request.tsq -in response.tsr -CAfile cacert.pemVerify a timestamp response against a request
🔎 Verify timestamp against data fileopenssl ts -verify -data file -in response.tsr -CAfile cacert.pemVerify a timestamp token against the original data

📋 SYNOPSIS

openssl ts -help

openssl ts -query [-config configfile] [-data file_to_hash] [-digest
digest_bytes] [-digest] [-tspolicy object_id] [-no_nonce] [-cert] [-in
request.tsq] [-out request.tsq] [-text] [-rand files] [-writerand file]
[-provider name] [-provider-path path] [-propquery propq]

openssl ts -reply [-config configfile] [-section tsa_section]
[-queryfile request.tsq] [-passin password_src] [-signer tsa_cert.pem]
[-inkey filename|uri] [-digest] [-chain certs_file.pem] [-tspolicy
object_id] [-in response.tsr] [-token_in] [-out response.tsr]
[-token_out] [-text] [-engine id] [-provider name] [-provider-path
path] [-propquery propq]

openssl ts -verify [-data file_to_hash] [-digest digest_bytes]
[-queryfile request.tsq] [-in response.tsr] [-token_in] [-untrusted
files|uris] [-CAfile file] [-CApath dir] [-CAstore uri]
[-allow_proxy_certs] [-attime timestamp] [-no_check_time]
[-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy]
[-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map]
[-partial_chain] [-policy arg] [-policy_check] [-policy_print]
[-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192]
[-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num]
[-verify_depth num] [-verify_email email] [-verify_hostname hostname]
[-verify_ip ip] [-verify_name name] [-x509_strict] [-issuer_checks]
[-provider name] [-provider-path path] [-propquery propq]

🔍 DESCRIPTION

This command is a basic Time Stamping Authority (TSA) client and server application as specified in RFC 3161 (Time-Stamp Protocol, TSP). A TSA can be part of a PKI deployment and its role is to provide long term proof of the existence of a certain datum before a particular time. Here is a brief description of the protocol:

  1. 📥 The TSA client computes a one-way hash value for a data file and sends the hash to the TSA.
  2. 📤 The TSA attaches the current date and time to the received hash value, signs them and sends the timestamp token back to the client. By creating this token the TSA certifies the existence of the original data file at the time of response generation.
  3. ✅ The TSA client receives the timestamp token and verifies the signature on it. It also checks if the token contains the same hash value that it had sent to the TSA.

There is one DER encoded protocol data unit defined for transporting a timestamp request to the TSA and one for sending the timestamp response back to the client. This command has three main functions: creating a timestamp request based on a data file, creating a timestamp response based on a request, verifying if a response corresponds to a particular request or a data file.

There is no support for sending the requests/responses automatically over HTTP or TCP yet as suggested in RFC 3161. The users must send the requests either by ftp or e-mail.

⚙️ OPTIONS

🕒 Timestamp Request generation

The -query command can be used for creating and printing a timestamp request with the following options:

🕓 Timestamp Response generation

A timestamp response (TimeStampResp) consists of a response status and the timestamp token itself (ContentInfo), if the token generation was successful. The -reply command is for creating a timestamp response or timestamp token based on a request and printing the response/token in human-readable format. If -token_out is not specified the output is always a timestamp response (TimeStampResp), otherwise it is a timestamp token (ContentInfo).

✅ Timestamp Response verification

The -verify command is for verifying if a timestamp response or timestamp token is valid and matches a particular timestamp request or data file. The -verify command does not use the configuration file.

📂 CONFIGURATION FILE OPTIONS

The -query and -reply commands make use of a configuration file. See config(5) for a general description of the syntax of the config file. The -query command uses only the symbolic OID names section and it can work without it. However, the -reply command needs the config file for its operation.

When there is a command line switch equivalent of a variable the switch always overrides the settings in the config file.

📚 EXAMPLES

All the examples below presume that OPENSSL_CONF is set to a proper configuration file, e.g. the example configuration file openssl/apps/openssl.cnf will do.

🕒 Timestamp Request

To create a timestamp request for design1.txt with SHA-256 digest, without nonce and policy, and without requirement for a certificate in the response:

openssl ts -query -data design1.txt -no_nonce \
      -out design1.tsq

To create a similar timestamp request with specifying the message imprint explicitly:

openssl ts -query -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
       -no_nonce -out design1.tsq

To print the content of the previous request in human readable format:

openssl ts -query -in design1.tsq -text

To create a timestamp request which includes the SHA-512 digest of design2.txt, requests the signer certificate and nonce, and specifies a policy id (assuming the tsa_policy1 name is defined in the OID section of the config file):

openssl ts -query -data design2.txt -sha512 \
      -tspolicy tsa_policy1 -cert -out design2.tsq

🕓 Timestamp Response

Before generating a response a signing certificate must be created for the TSA that contains the timeStamping critical extended key usage extension without any other key usage extensions. You can add this line to the user certificate section of the config file to generate a proper certificate;

extendedKeyUsage = critical,timeStamping

See openssl-req(1), openssl-ca(1), and openssl-x509(1) for instructions. The examples below assume that cacert.pem contains the certificate of the CA, tsacert.pem is the signing certificate issued by cacert.pem and tsakey.pem is the private key of the TSA.

To create a timestamp response for a request:

openssl ts -reply -queryfile design1.tsq -inkey tsakey.pem \
      -signer tsacert.pem -out design1.tsr

If you want to use the settings in the config file you could just write:

openssl ts -reply -queryfile design1.tsq -out design1.tsr

To print a timestamp reply to stdout in human readable format:

openssl ts -reply -in design1.tsr -text

To create a timestamp token instead of timestamp response:

openssl ts -reply -queryfile design1.tsq -out design1_token.der -token_out

To print a timestamp token to stdout in human readable format:

openssl ts -reply -in design1_token.der -token_in -text -token_out

To extract the timestamp token from a response:

openssl ts -reply -in design1.tsr -out design1_token.der -token_out

To add 'granted' status info to a timestamp token thereby creating a valid response:

openssl ts -reply -in design1_token.der -token_in -out design1.tsr

✅ Timestamp Verification

To verify a timestamp reply against a request:

openssl ts -verify -queryfile design1.tsq -in design1.tsr \
      -CAfile cacert.pem -untrusted tsacert.pem

To verify a timestamp reply that includes the certificate chain:

openssl ts -verify -queryfile design2.tsq -in design2.tsr \
      -CAfile cacert.pem

To verify a timestamp token against the original data file:

openssl ts -verify -data design2.txt -in design2.tsr \
      -CAfile cacert.pem

To verify a timestamp token against a message imprint:

openssl ts -verify -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
       -in design2.tsr -CAfile cacert.pem

You could also look at the 'test' directory for more examples.

🐛 BUGS

📜 HISTORY

OpenSSL 1.1.1 introduced a new random generator (CSPRNG) with an improved seeding mechanism. The new seeding mechanism makes it unnecessary to define a RANDFILE for saving and restoring randomness. This option is retained mainly for compatibility reasons.

The -engine option was deprecated in OpenSSL 3.0.

📖 SEE ALSO

openssl(1), tsget(1), openssl-req(1), openssl-x509(1), openssl-ca(1), openssl-genrsa(1), config(5), ossl_store-file(7)

©️ COPYRIGHT

Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

openssl-ts(1) □✕
📝 NAME 🚀 Quick Reference 📋 SYNOPSIS 🔍 DESCRIPTION ⚙️ OPTIONS
🕒 Timestamp Request generation 🕓 Timestamp Response generation ✅ Timestamp Response verification
📂 CONFIGURATION FILE OPTIONS 📚 EXAMPLES
🕒 Timestamp Request 🕓 Timestamp Response ✅ Timestamp Verification
🐛 BUGS 📜 HISTORY 📖 SEE ALSO ©️ COPYRIGHT

Generated by phpman v4.10.0-16-g1a0e228 Author: Che Dong Under GNU General Public License
2026-09-22 13:41 @216.73.217.0
CrawledBy Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
Valid XHTML 1.0 Transitional!Valid CSS!