TIMESOURCE

Property containing the fully qualified name of the class implementing the ITimeSource that should be used (OPTIONAL). Below are the built-in TimeSourceS available:
org.signserver.server.LocalComputerTimeSource
This is the default TimeSource and uses the time from the local computer and always returns the time.

org.signserver.server.StatusReadingLocalComputerTimeSource
This TimeSource returns the time from the local computer but only if the status property TIMESOURCE0_INSYNC is not expired and returned as true from the Status Repository.

Worker properties:

• LEAPSECOND_HANDLING: NONE, PAUSE or STOP. Default is NONE.

  • NONE: Leap seconds are not considered and time-stamp tokens are issued as usual.

  • PAUSE: The TimeSource will query the status property LEAPSECOND from the Status Repository. If this property is not expired, and has the value POSITIVE or NEGATIVE and current time is in the interval surrounding a potential leap second (23:59:58,989 - 00:00:01,010) (at month shifts, in UTC time), the TimeSource will make a pause to ensure the time value is not fetch on the leap second. The value NONE is interpreted as there is no leap second and the time value will be returned immediately as usual. If the value has expired, no valid time will be returned.

  • STOP: The TimeSource will query the status property in the same way as for the PAUSE strategy. During the interval surrounding a potential leap second no time will be returned. This will cause the response to the clients to be timeSourceNotAvailable. If the LEAPSECOND status property value has expired, no valid time will be returned.

  This time source will add an additional worker status item indicating the currently used leap second strategy.The following additional log fields will be included for a logger implementation to use:

  • LEAP_UPCOMING: This field will have the value true if a leap second is known to be coming soon, false if there is no leap second known to be coming, or unknown if it was unable to read the status.LEAP_PERIOD This field will be included when LEAP_UPCOMING is true and has the value true or false depending on whether the request was made during the time interval surrounding a leap second.LEAP_ACTION This field will include the value of the currently used leap second strategy.

SIGNATUREALGORITHM

Property specifying the algorithm used to sign the timestamp. Default: SHA256withRSA.

ACCEPTEDALGORITHMS

A ';' separated string containing accepted algorithms. Can be null if it should not be used. OPTIONAL but strongly recommended. Supported Algorithms are: GOST3411, MD5, SHA1, SHA224, SHA256, SHA384, SHA512, RIPEMD128, RIPEMD160, RIPEMD256.

ACCEPTEDPOLICIES

A ';' separated string containing accepted policies.

Note that only policies listed in this property are allowed to be requested. If the property does not contain any policies, then no policy can be requested. Requests not including any policy will use the default policy regardless of this property, but requests explicitly requesting the default policy will still not be allowed unless listed in this property. If this property is used, ACCEPTANYPOLICY cannot be set to true. OPTIONAL, recommended.

ACCEPTANYPOLICY

If set to true, allow any policy. If set to true, ACCEPTEDPOLICIES cannot be set. Optionally, this can be set to false or left empty when setting ACCEPTEDPOLICIES.

ACCEPTEDEXTENSIONS

A ';' separated string containing accepted extensions, can be null if it should not be used. OPTIONAL.

DEFAULTTSAPOLICYOID

The default policy ID of the time stamp authority. REQUIRED, if no policy OID is specified in the request, then will this value be used.

ACCURACYMICROS

Accuracy in micro seconds, Only decimal number format, only one of the accuracy properties should be set. OPTIONAL.

ACCURACYMILLIS

Accuracy in milliseconds, Only decimal number format, only one of the accuracy properties should be set. OPTIONAL.

ACCURACYSECONDS

Accuracy in seconds. Only decimal number format, only one of the accuracy properties should be set. OPTIONAL.

ORDERING

The ordering (OPTIONAL), default false. Only false is supported.

INCLUDEORDERING

If set to true, always include the ordering attribute, even when ORDERING is set to false. It is not allowed to set this to false when ORDERING is set to true, default is false. OPTIONAL.

TSA

General name of the Time Stamp Authority. OPTIONAL.

TSA_FROM_CERT

Setting this property to true sets the general name of the Time Stamp Authority to the subject DN of the signing certificate. This cannot be set to true if the TSA property is set. OPTIONAL, default is to not set the general name.

REQUIREVALIDCHAIN

Set to true to perform an extra check that the SIGNERCERTCHAIN only contains certificates in the chain of the signer certificate. OPTIONAL, default false.

MAXSERIALNUMBERLENGTH

The maximum size (in bytes) used when generating serial numbers, must be between 8 and 20 (64 - 160 bits) (Default: 8). The generated serial number will always be positive (so the sign bit is always a zero).

WORKERLOGGER

As for other workers this property can be used to specify which worker logger to use. By default, the DefaultTimeStampLogger is used.

INCLUDESTATUSSTRING

Specifies if the status string is to be included in the response. Setting this to true triggers a bug in some versions of OpenJDK's jarsigner utility, default is false. OPTIONAL.

INCLUDE_CERTID_ISSUERSERIAL

Specifies if the signingCertificate (or signingCertificateV2) attribute's ESSCertID should include the issuer and serial number in addition to the certificate hash. Default is true.

INCLUDESIGNINGTIMEATTRIBUTE

Specifies if the signingTime signed CMS attribute should be included in the response, default is true. OPTIONAL.

INCLUDECMSALGORITHMPROTECTATTRIBUTE

Specifies if the cmsAlgorithmProtect (RFC#6211) signed attribute should be included in the response, default is true. OPTIONAL.

CERTIFICATE_DIGEST_ALGORITHM

Specifies the digest algorithm used for calculating the digest of the signing certificate. Supported values are: SHA1, SHA224, SHA256, SHA384, SHA512.
When using an algorithm other than SHA1, RFC 5816-compliant time stamps will be issued. To get the old behavior (with the ESSCertID attribute instead of ESSCertIDv2), SHA1 must be set explicitly. Default: SHA256.

LEGACYENCODING

As of SignServer 4.0, the encoding of the time-stamp tokens has changed. One consequence is that the order of the certificates in the output might not be the same as in the certificate chain due to the DER encoding and the fact that the certificates field is a set and thus not ordered. To restore the old behavior, set LEGACYENCODING=true. Default is false. OPTIONAL.

VERIFY_TOKEN_SIGNATURE

Specifies if the timestamp token signature is to be validated after signing. Signing fails if validation is not successful. Default is true.