Document Timestamps
Append a standalone /DocTimeStamp archive revision — the PAdES-B-LTA archive stamp — and re-apply it to renew long-term validity before a timestamp certificate expires
A document timestamp is an RFC-3161 timestamp applied to the entire document as its own revision, rather than embedded inside a single signature's CMS. It is the archive stamp at the top of the PAdES B-LTA profile: it timestamps the signed bytes and the DSS validation material, so the whole long-term-validation package is anchored to a trusted time.
add_document_timestamp appends one as a new incremental revision with SubFilter
/ETSI.RFC3161, leaving every existing signature intact:
use mudrit_pdfsign::prelude::*;
let stamped = add_document_timestamp(
&signed,
&UrlTimestamper::new("http://timestamp.comodoca.com"),
)?;
std::fs::write("stamped.pdf", &stamped)?;The second argument is any Timestamper — the built-in
UrlTimestamper (optionally authenticated with .basic_auth / .bearer / .header), or your own
mutual-TLS / proxy client. The output is plaintext (the archival revisions assume a
non-encrypted signed document).
Signature timestamp vs document timestamp
Both are RFC-3161 tokens, but they cover different things:
| Signature timestamp | Document timestamp | |
|---|---|---|
| Attached via | .timestamp(Timestamp::url(...)) | add_document_timestamp(prev, &ts) |
| SubFilter | inside the signature's CMS | a /DocTimeStamp revision, /ETSI.RFC3161 |
| Covers | the one signature | the whole document, including the DSS |
| PAdES role | required for B-T and up | the B-LTA archive stamp |
Reaching for PAdES B-LTA via .pades(PadesLevel::B_LTA) adds this archive
stamp for you as part of the profile. Call add_document_timestamp directly when you need it on its
own — for example to renew an existing archive (below), or to stamp a document you assembled
outside the normal sign path.
Re-applying for long-term renewal
The function is re-appliable: run it again over a previously archived document to add a fresh archive stamp. Do this before the prior timestamp's own certificate expires — the new stamp attests that the earlier one was valid at the time it was applied, chaining trust forward indefinitely. This is how a PAdES-B-LTA document survives beyond any single TSA certificate's lifetime.
use mudrit_pdfsign::prelude::*;
// Years later, before the previous archive stamp's TSA cert lapses — renew it:
let renewed = add_document_timestamp(
&archived_pdf,
&UrlTimestamper::new("https://tsa.company.com/tsr").bearer("my-token"),
)?;Refresh the DSS too on renewal
A renewal typically pairs the fresh stamp with up-to-date revocation material so the newly relevant certificates are also covered — sign or re-archive with current CRL/OCSP data (see Long-Term Validation) so each renewal remains independently verifiable.