Error reference: Timestamp
Is the RFC 3161 timestamp valid, bound to the content and traceable to an anchor of the verifying party?
The last check asks whether the point in time is proven independently. It checks a timestamp following RFC 3161: whether it is readable, whether its hash matches the timestamped content and whether its certificate chain ends at an anchor the verifying party has provided.
An anchored timestamp is required for the highest level, KYA-A4.
tsa_malformed
The timestamp cannot be read.
Cause: The timestamp is not readable, for example because the file is damaged or not an RFC 3161 timestamp.
Fix: Load the original file again. The timestamp inspector shows whether the structure is readable.
tsa_imprint_mismatch
The timestamp covers different content.
Cause: The hash in the timestamp does not match the timestamped content. The content was altered after timestamping, or the wrong content was timestamped.
Fix: Compare the hash in the timestamp inspector with the hash of your data. Timestamp the content in its final form.
tsa_anchor_not_provided
No timestamp anchor provided. Add it under “Trust of the verifying party”.
Cause: No timestamp anchor is provided. The timestamp's signature can be verified but not attributed to a trusted authority.
Fix: Provide the certificate of the timestamp authority or its root under timestamp anchors.
tsa_not_trusted
The timestamp does not lead to any of the provided anchors.
Cause: The timestamp's certificate chain does not end at an anchor provided.
Fix: Check whether the correct anchor is provided. Trust only timestamp authorities whose anchor you have from a trusted source.
tsa_target_unknown
It is unclear which content the timestamp covers.
Cause: It cannot be determined what the timestamp refers to, for example because the timestamped content is not included.
Fix: Present the timestamp together with the timestamped content, ideally in an evidence pack.
no_timestamp
No timestamp present.
Cause: The evidence contains no timestamp. The point in time is then not proven independently, and the highest level, KYA-A4, cannot be reached.
Fix: Have the hash of the receipt chain timestamped regularly by a timestamp authority and include the timestamp.
Common situations
Most often the timestamp anchor is missing. The timestamp's signature can then be verified but not attributed to a trusted authority. Provide the authority's certificate as PEM. The timestamp inspector shows in advance which authority issued the timestamp.
How to test this check
Open the “Complete pack” example and remove the timestamp anchor. The check then reports the missing anchor, and the level drops below KYA-A4. With the anchor provided, the check becomes valid again.