Skip to content
NOQTIS

noqtis-timestamp(1)

noqtis-timestamp — add an RFC 3161 timestamp to a sealed capsule

noqtis timestamp --tsa url ... [--anchor der-file ...] [--force] dir

noqtis timestamp asks a time-stamping authority (RFC 3161) for a token over the signature of the capsule dir, sealed before with noqtis-seal(1), and stores it in noqtis.sig. The manifest noqtis.json and the signature are not changed, so the capsule still checks; with the TSA's certificate as an anchor, noqtis-check(1) then also shows when the seal existed.

The seal and the manifest must read (as noqtis-inspect(1) reads them) before any TSA is asked. The request is the SHA-256 of the seal's signature, a random nonce and a request for the TSA's certificate, sent by an HTTP/1.1 POST; the reply is stored only once it checks: granted, its imprint the hash of this signature, its nonce the one sent, and its signature valid under the TSA certificate at genTime. The TSA certificate is checked at genTime and not for revocation, so a TSA key stolen later could make tokens with an earlier genTime; see SECURITY CONSIDERATIONS in noqtis-capsule(5). Give --tsa more than once for fallbacks: they are tried in order until one gives a token that checks. When none does, nothing is written and the exit status is 2.

A seal holds one timestamp. A capsule that already has one is refused unless --force is given, since replacing a timestamp gives up the earlier time it proves.

url
A time-stamping authority, ‘http://’, or ‘https://’ with the TLS client (see noqtis-seal(1)): the token is signed by the TSA, so TLS adds no integrity. At most 32.
der-file
The TSA's root or issuing certificate, DER-encoded: the token must then also verify under one of the anchors before it is stored. At most 32.
Replace a timestamp the seal already has.

0
a timestamp was stored
2
a usage error, a folder that is not a sealed capsule, a timestamp already there without --force, or no TSA gave a token that checks (nothing written)

$ noqtis seal -k me results
$ noqtis timestamp --tsa http://timestamp.digicert.com results
timestamp from http://timestamp.digicert.com: genTime 2026-10-29T16:02:11Z
timestamped results
$ noqtis check -p me.pub --anchor digicert.der results

noqtis(1), noqtis-check(1), noqtis-inspect(1), noqtis-seal(1), nqtsput(3), noqtis-capsule(5)

Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP), RFC 3161.