---
title: "Verify a timestamp (RFC 3161, with FreeTSA)"
url: https://knowyouragent.ch/en/knowledge/guides/verify-timestamp
lang: en
updated: 2026-10-13
license: © Innopulse Consulting GmbH
---

# Verify a timestamp (RFC 3161, with FreeTSA)

A timestamp following RFC 3161 proves that certain data existed at a point in time. This guide creates a timestamp with the freely accessible FreeTSA service and then verifies it with KYA.

[Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH
Published 13 October 2026

## Key points

- What gets timestamped is a file's hash, never the file itself.
- OpenSSL and FreeTSA are enough to create a [timestamp](https://knowyouragent.ch/en/knowledge/glossary/rfc-3161-timestamp) following RFC 3161.
- KYA verifies the timestamp against the anchor you provide as a PEM certificate.
- For disputes, a recognized trust service is better suited than a freely accessible service.

## Create a request with the hash

What gets timestamped is not the file itself but its hash. OpenSSL creates a request in the RFC 3161 format from a file, such as a receipt:

```
openssl ts -query -data receipt.json -sha256 -cert -out request.tsq
```

The -cert option asks the timestamp authority to include its certificate in the response. The file does not leave your device, only the hash does.

## Send the request to FreeTSA

Send the request to the timestamp authority. FreeTSA is a freely accessible service suitable for testing:

```
curl -s -H "Content-Type: application/timestamp-query" \
  --data-binary @request.tsq https://freetsa.org/tsr -o response.tsr
```

The file response.tsr now contains the signed timestamp with the hash, the time and the authority's signature.

## Fetch the root certificate and cross-check locally

Download FreeTSA's root certificate and verify the timestamp with OpenSSL against the original request:

```
curl -s -O https://freetsa.org/files/cacert.pem
openssl ts -verify -in response.tsr -queryfile request.tsq -CAfile cacert.pem
```

If OpenSSL reports “Verification: OK”, timestamp, hash and certificate chain match. This cross-check is optional, but it shows that two independent tools reach the same result.

## Verify in KYA

Open the [verification page](https://knowyouragent.ch/en/verify) and load response.tsr through the file button. Then open the advanced section for keys, status lists and timestamp anchors, paste the content of cacert.pem under “Timestamp anchors (PEM certificate)” and click “Verify”.

In the check for the point in time, the certificate shows whether the authority's signature is valid and the chain ends at the anchor provided. Without an anchor, KYA reports that the time is not anchored.

## Interpret the result

A timestamp proves the point in time for a hash. Whether this hash belongs to your file is shown by comparing it with the file's hash; in an [evidence pack](https://knowyouragent.ch/en/knowledge/glossary/evidence-pack), KYA checks this binding itself.

FreeTSA is suitable for tests and internal purposes. For disputes, a recognized trust service whose timestamps count as a [qualified timestamp](https://knowyouragent.ch/en/knowledge/glossary/qualified-timestamp) is advisable.

## Frequently asked questions

### Is a FreeTSA timestamp legally qualified?

No. FreeTSA is a freely accessible service without legal recognition as a qualified trust service. Technically, the timestamp can still be verified following RFC 3161.

### Do I have to send the file to FreeTSA?

No. Only the file's hash is sent. The content cannot be computed back from the hash.

### Why does KYA need the timestamp anchor?

Because only the anchor proves which authority the timestamp belongs to. The decision which timestamp authorities to trust lies with the [verifying party](https://knowyouragent.ch/en/knowledge/glossary/verifying-party).

### Can I secure several files with one timestamp?

Yes. Compute a hash over all files, for example over a [receipt chain](https://knowyouragent.ch/en/knowledge/glossary/receipt-chain) or a manifest, and have this single hash timestamped. This secures every file whose hash is in the manifest, and any later change is detected.

### How long can a FreeTSA timestamp be verified?

As long as the root certificate is available. Keep it together with the timestamp.

## Sources

- RFC 3161: Time-Stamp Protocol: [https://www.rfc-editor.org/rfc/rfc3161](https://www.rfc-editor.org/rfc/rfc3161)
- FreeTSA: [https://freetsa.org/](https://freetsa.org/)
- OpenSSL: openssl-ts: [https://docs.openssl.org/master/man1/openssl-ts/](https://docs.openssl.org/master/man1/openssl-ts/)

---
Quelle: https://knowyouragent.ch/en/knowledge/guides/verify-timestamp · KYA – Know Your Agent