Timestamps

An RFC-3161 timestamp binds a signature to a moment in time attested by a trusted Time-Stamp Authority (TSA), independent of the signer's own clock. See the Timestamps guide for a narrative walkthrough; this page is the exhaustive API shape.

Timestamp

How (and whether) to attach an RFC-3161 signature timestamp. Set via SignConfigBuilder::timestamp.

Default: Timestamp::None.

let t = Timestamp::url("https://tsa.company.com/tsr").basic_auth("user", "pass");
let plain = Timestamp::url("http://timestamp.comodoca.com");   // default: no auth
let off = Timestamp::None;

Timestamp's Debug impl never prints credentials — it shows only the variant and, for Url, the URL.

UrlTimestamper

The built-in Timestamper: a http:// or https:// RFC-3161 TSA, with optional authentication. Pure-Rust TLS (rustls) — no OpenSSL, no system libraries. Its fields are private; construct and configure it through these methods (or reach it indirectly via Timestamp::url(...)).

let ts = UrlTimestamper::new("https://tsa.company.com/tsr").basic_auth("user", "pass");

The Timestamper trait

A source of RFC-3161 timestamp tokens. The SDK builds the TimeStampReq (DER) and hands it to timestamp; the implementation POSTs it to the TSA — handling TLS, authentication, proxies, etc. — and returns the raw TimeStampResp (DER). The SDK then extracts and verifies the token.

pub trait Timestamper {
    fn timestamp(&self, request: &[u8]) -> Result<Vec<u8>>;
}

The SDK verifies the returned token commits to this request — its messageImprint must match the digest sent, and any nonce it carries must echo the one generated — so a stale or mismatched response is rejected before it can be embedded. A missing nonce is tolerated (many public TSAs omit it); a present-but-different nonce is fatal.

struct ProtectedTsa { token: String }

impl Timestamper for ProtectedTsa {
    fn timestamp(&self, request: &[u8]) -> Result<Vec<u8>> {
        // your own HTTPS client with auth — e.g. reqwest::blocking:
        let resp = reqwest::blocking::Client::new()
            .post("https://tsa.example.com/tsr")
            .bearer_auth(&self.token)
            .header("Content-Type", "application/timestamp-query")
            .body(request.to_vec())
            .send().and_then(|r| r.error_for_status()).and_then(|r| r.bytes())
            .map_err(|e| mudrit_pdfsign::Error::Network(e.to_string()))?;
        Ok(resp.to_vec()) // the raw TimeStampResp
    }
}

DEFAULT_TSA_URL

pub const DEFAULT_TSA_URL: &str = "http://timestamp.comodoca.com";

The default RFC-3161 timestamp authority. Used internally when a profile requires a timestamp (for example PAdES B-T and up) but no explicit Timestamp source was configured.

Next