How to use the command openssl ts (with examples)

OpenSSL ts command is used to generate and verify timestamps. It provides various options to generate timestamp request, check timestamp response, verify timestamp request and response, and create timestamp response using key and signing certificate.

Use case 1: Generate a SHA-512 timestamp request of a specific file and output to file.tsq

Code:

openssl ts -query -data path/to/file -sha512 -out path/to/file.tsq

Motivation: Generating a timestamp request for a specific file allows you to securely record the creation or modification time of the file. This can be useful for establishing document authenticity or tracking events in a log file.

Explanation:

• ts: The main command to access the timestamp functionality in OpenSSL.
• -query: Specifies that a timestamp request should be generated.
• -data path/to/file: Specifies the path to the file for which a timestamp request should be generated.
• -sha512: Specifies the hash algorithm to be used for generating the timestamp request. In this case, SHA-512 is used.
• -out path/to/file.tsq: Specifies the output file path where the generated timestamp request will be saved.

Example output: No output is displayed on the command line. The generated timestamp request is saved to the specified output file path.

Use case 2: Check the date and metadata of a specific timestamp response file

Code:

openssl ts -reply -in path/to/file.tsr -text

Motivation: Checking the date and metadata of a timestamp response file allows you to verify the authenticity and integrity of the timestamp. It helps ensure that the timestamp has not been tampered with and provides information about when the timestamp was generated.

Explanation:

• ts: The main command to access the timestamp functionality in OpenSSL.
• -reply: Specifies that the operation is to check the timestamp response.
• -in path/to/file.tsr: Specifies the path to the timestamp response file that needs to be checked.
• -text: Specifies that the output should be in text format, displaying the date and metadata of the timestamp response.

Example output: The output will display the date and metadata of the specified timestamp response file in a human-readable format.

Use case 3: Verify a timestamp request file and a timestamp response file from the server with an SSL certificate file

Code:

openssl ts -verify -in path/to/file.tsr -queryfile path/to/file.tsq -partial_chain -CAfile path/to/cert.pem

Motivation: Verifying a timestamp request and response files ensures the integrity and authenticity of the timestamps. By using an SSL certificate file, you can establish trust in the server providing the timestamps.

Explanation:

• ts: The main command to access the timestamp functionality in OpenSSL.
• -verify: Specifies that the operation is to verify the timestamp.
• -in path/to/file.tsr: Specifies the path to the timestamp response file that needs to be verified.
• -queryfile path/to/file.tsq: Specifies the path to the timestamp request file that corresponds to the provided timestamp response file.
• -partial_chain: Specifies that a partial certificate chain should be used for verification.
• -CAfile path/to/cert.pem: Specifies the path to the SSL certificate file that contains the public key used to verify the timestamp.

Example output: The output will indicate whether the timestamp request and response files are valid and if they can be trusted based on the provided SSL certificate. Any errors or issues with the verification process will also be displayed.

Use case 4: Create a timestamp response for a request using key and signing certificate and output it to file.tsr

Code:

openssl ts -reply -queryfile path/to/file.tsq -inkey path/to/tsakey.pem -signer tsacert.pem -out path/to/file.tsr

Motivation: Creating a timestamp response allows you to generate a timestamp that can be used to establish the time of document creation or modification. By using a key and signing certificate, the timestamp can be digitally signed for added security and trust.

Explanation:

• ts: The main command to access the timestamp functionality in OpenSSL.
• -reply: Specifies that the operation is to create a timestamp response.
• -queryfile path/to/file.tsq: Specifies the path to the timestamp request file for which a response should be generated.
• -inkey path/to/tsakey.pem: Specifies the path to the private key file used for signing the timestamp response.
• -signer tsacert.pem: Specifies the path to the certificate file used for signing the timestamp response.
• -out path/to/file.tsr: Specifies the output file path where the generated timestamp response will be saved.

Example output: No output is displayed on the command line. The generated timestamp response is saved to the specified output file path.

Conclusion:

The OpenSSL ts command provides a comprehensive set of options to generate, verify, and manipulate timestamps. Whether you need to generate timestamp requests, check timestamp responses, or create timestamp responses with digital signatures, the ts command offers the flexibility and functionality required for timestamp-related operations. By understanding the different use cases of the command, you can effectively utilize OpenSSL’s timestamp functionality in your operations.