timestamp | Keyfactor Docs

Use the SignClient timestamp command to request a timestamp:

$ bin/signclient timestamp
usage: timestamp <options> [url]

Command Options

Option	Description
`-base64`	Provide option to base64 encode the stored request or reply. Default is to not encode.
`-cafile <cafile>`	Input file containing one or multiple PEM encoded certificates that will be used as trustanchors for certificate chain validation.
`-certreq`	Request Signer certificate.
`-digestalgorithm <string>`	Digest algorithm used for creating timestamp request hash. Default: `SHA256`
`-help`	Print this message.
`-infile <file>`	File containing message to timestamp.
`-inrep <file>`	Input file containing an earlier stored base64 encoded response to verify. You must specify the `verify` flag also.
`-inreq <file>`	Input file containing an earlier stored request to use instead of creating a new. You must specify the `request` flag also.
`-instr <string>`	String to be timestamped. If neither `instr` or `infile` is provided, the client works in test-mode generating its own message.
`-keyalias <arg>`	Alias of the key in the keystore to use for authentication.
`-keystore <arg>`	Keystore with private key and certificate for client certificate authentication.
`-keystorepwd <arg>`	Password for reading the keystore. If `-keystore` is specified but not `-keystorepwd`, the CLI instead prompts for the password.
`-outrep <file>`	Output file to store the received TSA reply. By default, the reply is not stored.
`-outreq <file>`	Output file to store the sent TSA request. By default, the request is not stored.
`-print`	Prints content of a request, response, or token.
`-reqpolicy <oid>`	Request timestamp issued under a policy OID.
`-signerfile <file>`	Input file containing the PEM-encoded certificate of the TSA signer. Used to verify a stored response.
`-sleep <num>`	Sleep a number of milliseconds after each request. Default: `1000`
`-truststore <arg>`	Keystore with trusted certificates to use with HTTPS.
`-truststorepwd <arg>`	Password for the keystore with trusted certificates. If `-truststore` is specified but not `-truststorepwd`, the CLI instead prompts for the password.
`-url <url>`	Url of TSA. Example: `http://127.0.0.1:8080/signserver/process?workerId=1`
`-verify`	Verify the stored reply. You must also specify `inrep` and `cafile`. If set, no request to the TSA happens.

Example Use Cases

Send a Timestamp Request

Send a timestamp request to a specific Worker by passing its name as a URL query parameter, rather than using -workername or -workerid flags:

timestamp -url http://localhost:8080/signserver/tsa?workerName=TimeStampSigner

This is an alternative way to target a Worker when using the TSA servlet endpoint directly.

Read a Timestamp Request File

Read an existing timestamp request file (.tsq) from disk and print the contents in human-readable form:

timestamp -print -inreq query.tsq

No request is sent to the server. This is purely for inspecting a previously saved request.

Read a Timestamp Response File

Read an existing timestamp response file (.tsr) from disk and prints the contents in human-readable form:

timestamp -print -inrep reply.tsr

Again, no server communication. Useful for inspecting or verifying a timestamp token.