Skip to content

Full chain included in replies

Compare
Choose a tag to compare
@elbosso elbosso released this 18 Sep 13:10
· 100 commits to master since this release

Prior to this version, the replies always only contained the certificate of the signer - never any certificates of root or intermediary CAs. This was all well and good as the server offered the chain certificates as a separate download - so if one needed those to verify a timestamp, they were close at hand. And individual timestamps did not need this much bandwidth to begin with.

However, many tools bothered end users with warnings about being unable to fully verify the PKIX-chain or something of that kind (looking at you, jarsigner!). Therefore - this release gives the administrator the choice: Either keep the operation as it was before or set the new environment variable de.elbosso.tools.rfc3161timestampingserver.App.includeFullChain to true - this changes things insofar as now every timestamp generated contains all certificate in the chain - starting from the signing certificate up to and including the root certificate.

This change is backward compatible - any already issued timestamps are still valid. However, if the administrator decides to change the behaviour to include the chain certificates, timestamps issued before that switch is made naturally will only contain the signers certificate - there is no conversion of older timestamps - after all - how could it be?