850 lines
28 KiB
HTML
850 lines
28 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of TS</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>TS</H1>
|
|
Section: OpenSSL (1SSL)<BR>Updated: 2021-03-22<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
openssl-ts, ts - Time Stamping Authority tool (client/server)
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
|
|
|
|
<B>openssl</B> <B>ts</B>
|
|
<B>-query</B>
|
|
[<B>-rand file...</B>]
|
|
[<B>-writerand file</B>]
|
|
[<B>-config</B> configfile]
|
|
[<B>-data</B> file_to_hash]
|
|
[<B>-digest</B> digest_bytes]
|
|
[<B>-</B>digest<B></B>]
|
|
[<B>-tspolicy</B> object_id]
|
|
[<B>-no_nonce</B>]
|
|
[<B>-cert</B>]
|
|
[<B>-in</B> request.tsq]
|
|
[<B>-out</B> request.tsq]
|
|
[<B>-text</B>]
|
|
<P>
|
|
|
|
<B>openssl</B> <B>ts</B>
|
|
<B>-reply</B>
|
|
[<B>-config</B> configfile]
|
|
[<B>-section</B> tsa_section]
|
|
[<B>-queryfile</B> request.tsq]
|
|
[<B>-passin</B> password_src]
|
|
[<B>-signer</B> tsa_cert.pem]
|
|
[<B>-inkey</B> file_or_id]
|
|
[<B>-</B>digest<B></B>]
|
|
[<B>-chain</B> certs_file.pem]
|
|
[<B>-tspolicy</B> object_id]
|
|
[<B>-in</B> response.tsr]
|
|
[<B>-token_in</B>]
|
|
[<B>-out</B> response.tsr]
|
|
[<B>-token_out</B>]
|
|
[<B>-text</B>]
|
|
[<B>-engine</B> id]
|
|
<P>
|
|
|
|
<B>openssl</B> <B>ts</B>
|
|
<B>-verify</B>
|
|
[<B>-data</B> file_to_hash]
|
|
[<B>-digest</B> digest_bytes]
|
|
[<B>-queryfile</B> request.tsq]
|
|
[<B>-in</B> response.tsr]
|
|
[<B>-token_in</B>]
|
|
[<B>-CApath</B> trusted_cert_path]
|
|
[<B>-CAfile</B> trusted_certs.pem]
|
|
[<B>-untrusted</B> cert_file.pem]
|
|
[<I>verify options</I>]
|
|
<P>
|
|
|
|
<I>verify options:</I>
|
|
[-attime timestamp]
|
|
[-check_ss_sig]
|
|
[-crl_check]
|
|
[-crl_check_all]
|
|
[-explicit_policy]
|
|
[-extended_crl]
|
|
[-ignore_critical]
|
|
[-inhibit_any]
|
|
[-inhibit_map]
|
|
[-issuer_checks]
|
|
[-no_alt_chains]
|
|
[-no_check_time]
|
|
[-partial_chain]
|
|
[-policy arg]
|
|
[-policy_check]
|
|
[-policy_print]
|
|
[-purpose purpose]
|
|
[-suiteB_128]
|
|
[-suiteB_128_only]
|
|
[-suiteB_192]
|
|
[-trusted_first]
|
|
[-use_deltas]
|
|
[-auth_level num]
|
|
[-verify_depth num]
|
|
[-verify_email email]
|
|
[-verify_hostname hostname]
|
|
[-verify_ip ip]
|
|
[-verify_name name]
|
|
[-x509_strict]
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
|
|
|
|
The <B>ts</B> command is a basic Time Stamping Authority (<FONT SIZE="-1">TSA</FONT>) client and server
|
|
application as specified in <FONT SIZE="-1">RFC 3161</FONT> (Time-Stamp Protocol, <FONT SIZE="-1">TSP</FONT>). A
|
|
<FONT SIZE="-1">TSA</FONT> can be part of a <FONT SIZE="-1">PKI</FONT> deployment and its role is to provide long
|
|
term proof of the existence of a certain datum before a particular
|
|
time. Here is a brief description of the protocol:
|
|
<DL COMPACT>
|
|
<DT id="1">1.<DD>
|
|
The <FONT SIZE="-1">TSA</FONT> client computes a one-way hash value for a data file and sends
|
|
the hash to the <FONT SIZE="-1">TSA.</FONT>
|
|
<DT id="2">2.<DD>
|
|
The <FONT SIZE="-1">TSA</FONT> attaches the current date and time to the received hash value,
|
|
signs them and sends the time stamp token back to the client. By
|
|
creating this token the <FONT SIZE="-1">TSA</FONT> certifies the existence of the original
|
|
data file at the time of response generation.
|
|
<DT id="3">3.<DD>
|
|
The <FONT SIZE="-1">TSA</FONT> client receives the time stamp token and verifies the
|
|
signature on it. It also checks if the token contains the same hash
|
|
value that it had sent to the <FONT SIZE="-1">TSA.</FONT>
|
|
</DL>
|
|
<P>
|
|
|
|
There is one <FONT SIZE="-1">DER</FONT> encoded protocol data unit defined for transporting a time
|
|
stamp request to the <FONT SIZE="-1">TSA</FONT> and one for sending the time stamp response
|
|
back to the client. The <B>ts</B> command has three main functions:
|
|
creating a time stamp request based on a data file,
|
|
creating a time stamp response based on a request, verifying if a
|
|
response corresponds to a particular request or a data file.
|
|
<P>
|
|
|
|
There is no support for sending the requests/responses automatically
|
|
over <FONT SIZE="-1">HTTP</FONT> or <FONT SIZE="-1">TCP</FONT> yet as suggested in <FONT SIZE="-1">RFC 3161.</FONT> The users must send the
|
|
requests either by ftp or e-mail.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
|
|
|
|
<A NAME="lbAF"> </A>
|
|
<H3>Time Stamp Request generation</H3>
|
|
|
|
|
|
|
|
The <B>-query</B> switch can be used for creating and printing a time stamp
|
|
request with the following options:
|
|
<DL COMPACT>
|
|
<DT id="4"><B>-rand file...</B><DD>
|
|
|
|
|
|
A file or files containing random data used to seed the random number
|
|
generator.
|
|
Multiple files can be specified separated by an OS-dependent character.
|
|
The separator is <B>;</B> for MS-Windows, <B>,</B> for OpenVMS, and <B>:</B> for
|
|
all others.
|
|
<DT id="5">[<B>-writerand file</B>]<DD>
|
|
|
|
|
|
Writes random data to the specified <I>file</I> upon exit.
|
|
This can be used with a subsequent <B>-rand</B> flag.
|
|
<DT id="6"><B>-config</B> configfile<DD>
|
|
|
|
|
|
The configuration file to use.
|
|
Optional; for a description of the default value,
|
|
see ``<FONT SIZE="-1">COMMAND SUMMARY''</FONT> in <B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1).
|
|
<DT id="7"><B>-data</B> file_to_hash<DD>
|
|
|
|
|
|
The data file for which the time stamp request needs to be
|
|
created. stdin is the default if neither the <B>-data</B> nor the <B>-digest</B>
|
|
parameter is specified. (Optional)
|
|
<DT id="8"><B>-digest</B> digest_bytes<DD>
|
|
|
|
|
|
It is possible to specify the message imprint explicitly without the data
|
|
file. The imprint must be specified in a hexadecimal format, two characters
|
|
per byte, the bytes optionally separated by colons (e.g. 1A:F6:01:... or
|
|
1AF601...). The number of bytes must match the message digest algorithm
|
|
in use. (Optional)
|
|
<DT id="9"><B>-</B>digest<B></B><DD>
|
|
|
|
|
|
The message digest to apply to the data file.
|
|
Any digest supported by the OpenSSL <B>dgst</B> command can be used.
|
|
The default is <FONT SIZE="-1">SHA-1.</FONT> (Optional)
|
|
<DT id="10"><B>-tspolicy</B> object_id<DD>
|
|
|
|
|
|
The policy that the client expects the <FONT SIZE="-1">TSA</FONT> to use for creating the
|
|
time stamp token. Either the dotted <FONT SIZE="-1">OID</FONT> notation or <FONT SIZE="-1">OID</FONT> names defined
|
|
in the config file can be used. If no policy is requested the <FONT SIZE="-1">TSA</FONT> will
|
|
use its own default policy. (Optional)
|
|
<DT id="11"><B>-no_nonce</B><DD>
|
|
|
|
|
|
No nonce is specified in the request if this option is
|
|
given. Otherwise a 64 bit long pseudo-random none is
|
|
included in the request. It is recommended to use nonce to
|
|
protect against replay-attacks. (Optional)
|
|
<DT id="12"><B>-cert</B><DD>
|
|
|
|
|
|
The <FONT SIZE="-1">TSA</FONT> is expected to include its signing certificate in the
|
|
response. (Optional)
|
|
<DT id="13"><B>-in</B> request.tsq<DD>
|
|
|
|
|
|
This option specifies a previously created time stamp request in <FONT SIZE="-1">DER</FONT>
|
|
format that will be printed into the output file. Useful when you need
|
|
to examine the content of a request in human-readable
|
|
format. (Optional)
|
|
<DT id="14"><B>-out</B> request.tsq<DD>
|
|
|
|
|
|
Name of the output file to which the request will be written. Default
|
|
is stdout. (Optional)
|
|
<DT id="15"><B>-text</B><DD>
|
|
|
|
|
|
If this option is specified the output is human-readable text format
|
|
instead of <FONT SIZE="-1">DER.</FONT> (Optional)
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H3>Time Stamp Response generation</H3>
|
|
|
|
|
|
|
|
A time stamp response (TimeStampResp) consists of a response status
|
|
and the time stamp token itself (ContentInfo), if the token generation was
|
|
successful. The <B>-reply</B> command is for creating a time stamp
|
|
response or time stamp token based on a request and printing the
|
|
response/token in human-readable format. If <B>-token_out</B> is not
|
|
specified the output is always a time stamp response (TimeStampResp),
|
|
otherwise it is a time stamp token (ContentInfo).
|
|
<DL COMPACT>
|
|
<DT id="16"><B>-config</B> configfile<DD>
|
|
|
|
|
|
The configuration file to use.
|
|
Optional; for a description of the default value,
|
|
see ``<FONT SIZE="-1">COMMAND SUMMARY''</FONT> in <B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1).
|
|
See <B></B><FONT SIZE="-1"><B>CONFIGURATION FILE OPTIONS</B></FONT><B></B> for configurable variables.
|
|
<DT id="17"><B>-section</B> tsa_section<DD>
|
|
|
|
|
|
The name of the config file section containing the settings for the
|
|
response generation. If not specified the default <FONT SIZE="-1">TSA</FONT> section is
|
|
used, see <B></B><FONT SIZE="-1"><B>CONFIGURATION FILE OPTIONS</B></FONT><B></B> for details. (Optional)
|
|
<DT id="18"><B>-queryfile</B> request.tsq<DD>
|
|
|
|
|
|
The name of the file containing a <FONT SIZE="-1">DER</FONT> encoded time stamp request. (Optional)
|
|
<DT id="19"><B>-passin</B> password_src<DD>
|
|
|
|
|
|
Specifies the password source for the private key of the <FONT SIZE="-1">TSA.</FONT> See
|
|
<B></B><FONT SIZE="-1"><B>PASS PHRASE ARGUMENTS</B></FONT><B></B> in <B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1). (Optional)
|
|
<DT id="20"><B>-signer</B> tsa_cert.pem<DD>
|
|
|
|
|
|
The signer certificate of the <FONT SIZE="-1">TSA</FONT> in <FONT SIZE="-1">PEM</FONT> format. The <FONT SIZE="-1">TSA</FONT> signing
|
|
certificate must have exactly one extended key usage assigned to it:
|
|
timeStamping. The extended key usage must also be critical, otherwise
|
|
the certificate is going to be refused. Overrides the <B>signer_cert</B>
|
|
variable of the config file. (Optional)
|
|
<DT id="21"><B>-inkey</B> file_or_id<DD>
|
|
|
|
|
|
The signer private key of the <FONT SIZE="-1">TSA</FONT> in <FONT SIZE="-1">PEM</FONT> format. Overrides the
|
|
<B>signer_key</B> config file option. (Optional)
|
|
If no engine is used, the argument is taken as a file; if an engine is
|
|
specified, the argument is given to the engine as a key identifier.
|
|
<DT id="22"><B>-</B>digest<B></B><DD>
|
|
|
|
|
|
Signing digest to use. Overrides the <B>signer_digest</B> config file
|
|
option. (Mandatory unless specified in the config file)
|
|
<DT id="23"><B>-chain</B> certs_file.pem<DD>
|
|
|
|
|
|
The collection of certificates in <FONT SIZE="-1">PEM</FONT> format that will all
|
|
be included in the response in addition to the signer certificate if
|
|
the <B>-cert</B> option was used for the request. This file is supposed to
|
|
contain the certificate chain for the signer certificate from its
|
|
issuer upwards. The <B>-reply</B> command does not build a certificate
|
|
chain automatically. (Optional)
|
|
<DT id="24"><B>-tspolicy</B> object_id<DD>
|
|
|
|
|
|
The default policy to use for the response unless the client
|
|
explicitly requires a particular <FONT SIZE="-1">TSA</FONT> policy. The <FONT SIZE="-1">OID</FONT> can be specified
|
|
either in dotted notation or with its name. Overrides the
|
|
<B>default_policy</B> config file option. (Optional)
|
|
<DT id="25"><B>-in</B> response.tsr<DD>
|
|
|
|
|
|
Specifies a previously created time stamp response or time stamp token
|
|
(if <B>-token_in</B> is also specified) in <FONT SIZE="-1">DER</FONT> format that will be written
|
|
to the output file. This option does not require a request, it is
|
|
useful e.g. when you need to examine the content of a response or
|
|
token or you want to extract the time stamp token from a response. If
|
|
the input is a token and the output is a time stamp response a default
|
|
'granted' status info is added to the token. (Optional)
|
|
<DT id="26"><B>-token_in</B><DD>
|
|
|
|
|
|
This flag can be used together with the <B>-in</B> option and indicates
|
|
that the input is a <FONT SIZE="-1">DER</FONT> encoded time stamp token (ContentInfo) instead
|
|
of a time stamp response (TimeStampResp). (Optional)
|
|
<DT id="27"><B>-out</B> response.tsr<DD>
|
|
|
|
|
|
The response is written to this file. The format and content of the
|
|
file depends on other options (see <B>-text</B>, <B>-token_out</B>). The default is
|
|
stdout. (Optional)
|
|
<DT id="28"><B>-token_out</B><DD>
|
|
|
|
|
|
The output is a time stamp token (ContentInfo) instead of time stamp
|
|
response (TimeStampResp). (Optional)
|
|
<DT id="29"><B>-text</B><DD>
|
|
|
|
|
|
If this option is specified the output is human-readable text format
|
|
instead of <FONT SIZE="-1">DER.</FONT> (Optional)
|
|
<DT id="30"><B>-engine</B> id<DD>
|
|
|
|
|
|
Specifying an engine (by its unique <B>id</B> string) will cause <B>ts</B>
|
|
to attempt to obtain a functional reference to the specified engine,
|
|
thus initialising it if needed. The engine will then be set as the default
|
|
for all available algorithms. Default is builtin. (Optional)
|
|
</DL>
|
|
<A NAME="lbAH"> </A>
|
|
<H3>Time Stamp Response verification</H3>
|
|
|
|
|
|
|
|
The <B>-verify</B> command is for verifying if a time stamp response or time
|
|
stamp token is valid and matches a particular time stamp request or
|
|
data file. The <B>-verify</B> command does not use the configuration file.
|
|
<DL COMPACT>
|
|
<DT id="31"><B>-data</B> file_to_hash<DD>
|
|
|
|
|
|
The response or token must be verified against file_to_hash. The file
|
|
is hashed with the message digest algorithm specified in the token.
|
|
The <B>-digest</B> and <B>-queryfile</B> options must not be specified with this one.
|
|
(Optional)
|
|
<DT id="32"><B>-digest</B> digest_bytes<DD>
|
|
|
|
|
|
The response or token must be verified against the message digest specified
|
|
with this option. The number of bytes must match the message digest algorithm
|
|
specified in the token. The <B>-data</B> and <B>-queryfile</B> options must not be
|
|
specified with this one. (Optional)
|
|
<DT id="33"><B>-queryfile</B> request.tsq<DD>
|
|
|
|
|
|
The original time stamp request in <FONT SIZE="-1">DER</FONT> format. The <B>-data</B> and <B>-digest</B>
|
|
options must not be specified with this one. (Optional)
|
|
<DT id="34"><B>-in</B> response.tsr<DD>
|
|
|
|
|
|
The time stamp response that needs to be verified in <FONT SIZE="-1">DER</FONT> format. (Mandatory)
|
|
<DT id="35"><B>-token_in</B><DD>
|
|
|
|
|
|
This flag can be used together with the <B>-in</B> option and indicates
|
|
that the input is a <FONT SIZE="-1">DER</FONT> encoded time stamp token (ContentInfo) instead
|
|
of a time stamp response (TimeStampResp). (Optional)
|
|
<DT id="36"><B>-CApath</B> trusted_cert_path<DD>
|
|
|
|
|
|
The name of the directory containing the trusted <FONT SIZE="-1">CA</FONT> certificates of the
|
|
client. See the similar option of <B><A HREF="/cgi-bin/man/man2html?1+verify">verify</A></B>(1) for additional
|
|
details. Either this option or <B>-CAfile</B> must be specified. (Optional)
|
|
<DT id="37"><B>-CAfile</B> trusted_certs.pem<DD>
|
|
|
|
|
|
The name of the file containing a set of trusted self-signed <FONT SIZE="-1">CA</FONT>
|
|
certificates in <FONT SIZE="-1">PEM</FONT> format. See the similar option of
|
|
<B><A HREF="/cgi-bin/man/man2html?1+verify">verify</A></B>(1) for additional details. Either this option
|
|
or <B>-CApath</B> must be specified.
|
|
(Optional)
|
|
<DT id="38"><B>-untrusted</B> cert_file.pem<DD>
|
|
|
|
|
|
Set of additional untrusted certificates in <FONT SIZE="-1">PEM</FONT> format which may be
|
|
needed when building the certificate chain for the <FONT SIZE="-1">TSA</FONT>'s signing
|
|
certificate. This file must contain the <FONT SIZE="-1">TSA</FONT> signing certificate and
|
|
all intermediate <FONT SIZE="-1">CA</FONT> certificates unless the response includes them.
|
|
(Optional)
|
|
<DT id="39"><I>verify options</I><DD>
|
|
|
|
|
|
The options <B>-attime timestamp</B>, <B>-check_ss_sig</B>, <B>-crl_check</B>,
|
|
<B>-crl_check_all</B>, <B>-explicit_policy</B>, <B>-extended_crl</B>, <B>-ignore_critical</B>,
|
|
<B>-inhibit_any</B>, <B>-inhibit_map</B>, <B>-issuer_checks</B>, <B>-no_alt_chains</B>,
|
|
<B>-no_check_time</B>, <B>-partial_chain</B>, <B>-policy</B>, <B>-policy_check</B>,
|
|
<B>-policy_print</B>, <B>-purpose</B>, <B>-suiteB_128</B>, <B>-suiteB_128_only</B>,
|
|
<B>-suiteB_192</B>, <B>-trusted_first</B>, <B>-use_deltas</B>, <B>-auth_level</B>,
|
|
<B>-verify_depth</B>, <B>-verify_email</B>, <B>-verify_hostname</B>, <B>-verify_ip</B>,
|
|
<B>-verify_name</B>, and <B>-x509_strict</B> can be used to control timestamp
|
|
verification. See <B><A HREF="/cgi-bin/man/man2html?1+verify">verify</A></B>(1).
|
|
</DL>
|
|
<A NAME="lbAI"> </A>
|
|
<H2>CONFIGURATION FILE OPTIONS</H2>
|
|
|
|
|
|
|
|
The <B>-query</B> and <B>-reply</B> commands make use of a configuration file.
|
|
See <B><A HREF="/cgi-bin/man/man2html?5+config">config</A></B>(5)
|
|
for a general description of the syntax of the config file. The
|
|
<B>-query</B> command uses only the symbolic <FONT SIZE="-1">OID</FONT> names section
|
|
and it can work without it. However, the <B>-reply</B> command needs the
|
|
config file for its operation.
|
|
<P>
|
|
|
|
When there is a command line switch equivalent of a variable the
|
|
switch always overrides the settings in the config file.
|
|
<DL COMPACT>
|
|
<DT id="40"><B>tsa</B> section, <B>default_tsa</B><DD>
|
|
|
|
|
|
This is the main section and it specifies the name of another section
|
|
that contains all the options for the <B>-reply</B> command. This default
|
|
section can be overridden with the <B>-section</B> command line switch. (Optional)
|
|
<DT id="41"><B>oid_file</B><DD>
|
|
|
|
|
|
See <B><A HREF="/cgi-bin/man/man2html?1+ca">ca</A></B>(1) for description. (Optional)
|
|
<DT id="42"><B>oid_section</B><DD>
|
|
|
|
|
|
See <B><A HREF="/cgi-bin/man/man2html?1+ca">ca</A></B>(1) for description. (Optional)
|
|
<DT id="43"><B></B><FONT SIZE="-1"><B>RANDFILE</B></FONT><B></B><DD>
|
|
|
|
|
|
See <B><A HREF="/cgi-bin/man/man2html?1+ca">ca</A></B>(1) for description. (Optional)
|
|
<DT id="44"><B>serial</B><DD>
|
|
|
|
|
|
The name of the file containing the hexadecimal serial number of the
|
|
last time stamp response created. This number is incremented by 1 for
|
|
each response. If the file does not exist at the time of response
|
|
generation a new file is created with serial number 1. (Mandatory)
|
|
<DT id="45"><B>crypto_device</B><DD>
|
|
|
|
|
|
Specifies the OpenSSL engine that will be set as the default for
|
|
all available algorithms. The default value is builtin, you can specify
|
|
any other engines supported by OpenSSL (e.g. use chil for the NCipher <FONT SIZE="-1">HSM</FONT>).
|
|
(Optional)
|
|
<DT id="46"><B>signer_cert</B><DD>
|
|
|
|
|
|
<FONT SIZE="-1">TSA</FONT> signing certificate in <FONT SIZE="-1">PEM</FONT> format. The same as the <B>-signer</B>
|
|
command line option. (Optional)
|
|
<DT id="47"><B>certs</B><DD>
|
|
|
|
|
|
A file containing a set of <FONT SIZE="-1">PEM</FONT> encoded certificates that need to be
|
|
included in the response. The same as the <B>-chain</B> command line
|
|
option. (Optional)
|
|
<DT id="48"><B>signer_key</B><DD>
|
|
|
|
|
|
The private key of the <FONT SIZE="-1">TSA</FONT> in <FONT SIZE="-1">PEM</FONT> format. The same as the <B>-inkey</B>
|
|
command line option. (Optional)
|
|
<DT id="49"><B>signer_digest</B><DD>
|
|
|
|
|
|
Signing digest to use. The same as the
|
|
<B>-</B>digest<B></B> command line option. (Mandatory unless specified on the command
|
|
line)
|
|
<DT id="50"><B>default_policy</B><DD>
|
|
|
|
|
|
The default policy to use when the request does not mandate any
|
|
policy. The same as the <B>-tspolicy</B> command line option. (Optional)
|
|
<DT id="51"><B>other_policies</B><DD>
|
|
|
|
|
|
Comma separated list of policies that are also acceptable by the <FONT SIZE="-1">TSA</FONT>
|
|
and used only if the request explicitly specifies one of them. (Optional)
|
|
<DT id="52"><B>digests</B><DD>
|
|
|
|
|
|
The list of message digest algorithms that the <FONT SIZE="-1">TSA</FONT> accepts. At least
|
|
one algorithm must be specified. (Mandatory)
|
|
<DT id="53"><B>accuracy</B><DD>
|
|
|
|
|
|
The accuracy of the time source of the <FONT SIZE="-1">TSA</FONT> in seconds, milliseconds
|
|
and microseconds. E.g. secs:1, millisecs:500, microsecs:100. If any of
|
|
the components is missing zero is assumed for that field. (Optional)
|
|
<DT id="54"><B>clock_precision_digits</B><DD>
|
|
|
|
|
|
Specifies the maximum number of digits, which represent the fraction of
|
|
seconds, that need to be included in the time field. The trailing zeroes
|
|
must be removed from the time, so there might actually be fewer digits,
|
|
or no fraction of seconds at all. Supported only on <FONT SIZE="-1">UNIX</FONT> platforms.
|
|
The maximum value is 6, default is 0.
|
|
(Optional)
|
|
<DT id="55"><B>ordering</B><DD>
|
|
|
|
|
|
If this option is yes the responses generated by this <FONT SIZE="-1">TSA</FONT> can always
|
|
be ordered, even if the time difference between two responses is less
|
|
than the sum of their accuracies. Default is no. (Optional)
|
|
<DT id="56"><B>tsa_name</B><DD>
|
|
|
|
|
|
Set this option to yes if the subject name of the <FONT SIZE="-1">TSA</FONT> must be included in
|
|
the <FONT SIZE="-1">TSA</FONT> name field of the response. Default is no. (Optional)
|
|
<DT id="57"><B>ess_cert_id_chain</B><DD>
|
|
|
|
|
|
The SignedData objects created by the <FONT SIZE="-1">TSA</FONT> always contain the
|
|
certificate identifier of the signing certificate in a signed
|
|
attribute (see <FONT SIZE="-1">RFC 2634,</FONT> Enhanced Security Services). If this option
|
|
is set to yes and either the <B>certs</B> variable or the <B>-chain</B> option
|
|
is specified then the certificate identifiers of the chain will also
|
|
be included in the SigningCertificate signed attribute. If this
|
|
variable is set to no, only the signing certificate identifier is
|
|
included. Default is no. (Optional)
|
|
<DT id="58"><B>ess_cert_id_alg</B><DD>
|
|
|
|
|
|
This option specifies the hash function to be used to calculate the <FONT SIZE="-1">TSA</FONT>'s
|
|
public key certificate identifier. Default is sha1. (Optional)
|
|
</DL>
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
|
|
|
|
All the examples below presume that <B></B><FONT SIZE="-1"><B>OPENSSL_CONF</B></FONT><B></B> is set to a proper
|
|
configuration file, e.g. the example configuration file
|
|
openssl/apps/openssl.cnf will do.
|
|
<A NAME="lbAK"> </A>
|
|
<H3>Time Stamp Request</H3>
|
|
|
|
|
|
|
|
To create a time stamp request for design1.txt with <FONT SIZE="-1">SHA-1</FONT>
|
|
without nonce and policy and no certificate is required in the response:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -query -data design1.txt -no_nonce \
|
|
-out design1.tsq
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To create a similar time stamp request with specifying the message imprint
|
|
explicitly:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -query -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
|
|
-no_nonce -out design1.tsq
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To print the content of the previous request in human readable format:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -query -in design1.tsq -text
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To create a time stamp request which includes the <FONT SIZE="-1">MD-5</FONT> digest
|
|
of design2.txt, requests the signer certificate and nonce,
|
|
specifies a policy id (assuming the tsa_policy1 name is defined in the
|
|
<FONT SIZE="-1">OID</FONT> section of the config file):
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -query -data design2.txt -md5 \
|
|
-tspolicy tsa_policy1 -cert -out design2.tsq
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H3>Time Stamp Response</H3>
|
|
|
|
|
|
|
|
Before generating a response a signing certificate must be created for
|
|
the <FONT SIZE="-1">TSA</FONT> that contains the <B>timeStamping</B> critical extended key usage extension
|
|
without any other key usage extensions. You can add this line to the
|
|
user certificate section of the config file to generate a proper certificate;
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
extendedKeyUsage = critical,timeStamping
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
See <B><A HREF="/cgi-bin/man/man2html?1+req">req</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+ca">ca</A></B>(1), and <B><A HREF="/cgi-bin/man/man2html?1+x509">x509</A></B>(1) for instructions. The examples
|
|
below assume that cacert.pem contains the certificate of the <FONT SIZE="-1">CA,</FONT>
|
|
tsacert.pem is the signing certificate issued by cacert.pem and
|
|
tsakey.pem is the private key of the <FONT SIZE="-1">TSA.</FONT>
|
|
<P>
|
|
|
|
To create a time stamp response for a request:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -reply -queryfile design1.tsq -inkey tsakey.pem \
|
|
-signer tsacert.pem -out design1.tsr
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
If you want to use the settings in the config file you could just write:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -reply -queryfile design1.tsq -out design1.tsr
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To print a time stamp reply to stdout in human readable format:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -reply -in design1.tsr -text
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To create a time stamp token instead of time stamp response:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -reply -queryfile design1.tsq -out design1_token.der -token_out
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To print a time stamp token to stdout in human readable format:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -reply -in design1_token.der -token_in -text -token_out
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To extract the time stamp token from a response:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -reply -in design1.tsr -out design1_token.der -token_out
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To add 'granted' status info to a time stamp token thereby creating a
|
|
valid response:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -reply -in design1_token.der -token_in -out design1.tsr
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAM"> </A>
|
|
<H3>Time Stamp Verification</H3>
|
|
|
|
|
|
|
|
To verify a time stamp reply against a request:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -verify -queryfile design1.tsq -in design1.tsr \
|
|
-CAfile cacert.pem -untrusted tsacert.pem
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To verify a time stamp reply that includes the certificate chain:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ts -verify -queryfile design2.tsq -in design2.tsr \
|
|
-CAfile cacert.pem
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
To verify a time stamp token against the original data file:
|
|
<BR> openssl ts -verify -data design2.txt -in design2.tsr \
|
|
<BR> -CAfile cacert.pem
|
|
<P>
|
|
|
|
To verify a time stamp token against a message imprint:
|
|
<BR> openssl ts -verify -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
|
|
<BR> -in design2.tsr -CAfile cacert.pem
|
|
<P>
|
|
|
|
You could also look at the 'test' directory for more examples.
|
|
<A NAME="lbAN"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
|
|
|
|
<DL COMPACT>
|
|
<DT id="59">•<DD>
|
|
No support for time stamps over <FONT SIZE="-1">SMTP,</FONT> though it is quite easy
|
|
to implement an automatic e-mail based <FONT SIZE="-1">TSA</FONT> with <B><A HREF="/cgi-bin/man/man2html?1+procmail">procmail</A></B>(1)
|
|
and <B><A HREF="/cgi-bin/man/man2html?1+perl">perl</A></B>(1). <FONT SIZE="-1">HTTP</FONT> server support is provided in the form of
|
|
a separate apache module. <FONT SIZE="-1">HTTP</FONT> client support is provided by
|
|
<B><A HREF="/cgi-bin/man/man2html?1+tsget">tsget</A></B>(1). Pure <FONT SIZE="-1">TCP/IP</FONT> protocol is not supported.
|
|
<DT id="60">•<DD>
|
|
The file containing the last serial number of the <FONT SIZE="-1">TSA</FONT> is not
|
|
locked when being read or written. This is a problem if more than one
|
|
instance of <B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1) is trying to create a time stamp
|
|
response at the same time. This is not an issue when using the apache
|
|
server module, it does proper locking.
|
|
<DT id="61">•<DD>
|
|
Look for the <FONT SIZE="-1">FIXME</FONT> word in the source files.
|
|
<DT id="62">•<DD>
|
|
The source code should really be reviewed by somebody else, too.
|
|
<DT id="63">•<DD>
|
|
More testing is needed, I have done only some basic tests (see
|
|
test/testtsa).
|
|
</DL>
|
|
<A NAME="lbAO"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+tsget">tsget</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+openssl">openssl</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+req">req</A></B>(1),
|
|
<B><A HREF="/cgi-bin/man/man2html?1+x509">x509</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+ca">ca</A></B>(1), <B><A HREF="/cgi-bin/man/man2html?1+genrsa">genrsa</A></B>(1),
|
|
<B><A HREF="/cgi-bin/man/man2html?5+config">config</A></B>(5)
|
|
<A NAME="lbAP"> </A>
|
|
<H2>COPYRIGHT</H2>
|
|
|
|
|
|
|
|
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
<P>
|
|
|
|
Licensed under the OpenSSL license (the ``License''). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file <FONT SIZE="-1">LICENSE</FONT> in the source distribution or at
|
|
<<A HREF="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</A>>.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="64"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="65"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="66"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="67"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DL>
|
|
<DT id="68"><A HREF="#lbAF">Time Stamp Request generation</A><DD>
|
|
<DT id="69"><A HREF="#lbAG">Time Stamp Response generation</A><DD>
|
|
<DT id="70"><A HREF="#lbAH">Time Stamp Response verification</A><DD>
|
|
</DL>
|
|
<DT id="71"><A HREF="#lbAI">CONFIGURATION FILE OPTIONS</A><DD>
|
|
<DT id="72"><A HREF="#lbAJ">EXAMPLES</A><DD>
|
|
<DL>
|
|
<DT id="73"><A HREF="#lbAK">Time Stamp Request</A><DD>
|
|
<DT id="74"><A HREF="#lbAL">Time Stamp Response</A><DD>
|
|
<DT id="75"><A HREF="#lbAM">Time Stamp Verification</A><DD>
|
|
</DL>
|
|
<DT id="76"><A HREF="#lbAN">BUGS</A><DD>
|
|
<DT id="77"><A HREF="#lbAO">SEE ALSO</A><DD>
|
|
<DT id="78"><A HREF="#lbAP">COPYRIGHT</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:28 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|