timestamp : Java Glossary

Java jarsigner.exe has a feature to make such a request right while signing to get an accurate timestamp. You use the -tsa url or -tsacert alias to to connect to a timestamp service.

You could do something similar with a backup CD to prove you had composed all those works by the backup date, which might come in handy later in a patent or copyright lawsuit.

You send the Certificate Authority a *.tsq file, mime type application/timestamp-query, and get back a *.tsr file application/timestamp-reply. The protocol could not be simpler. You send a file using standard HTTP. You get a file. The DER-base64 formats of the files are defined by RFC 3161 which is part of X.509. As usual the RFC is written in Greek. I suggest snooping on a timestamping conversation with a protocol sniffer to undersand better how it works. RFC 3161 covers timestamping signatures. RFC 5126 covers long term electronic signatures.

Currently, J2SE 5.0+ time stamping does not work with the Verisign time stamping authority. Jarsigner communicates with the time stamping authority through a time stamping protocol (RFC 3161) which Verisign currently does not support. Unfortunately, there is no timestamping for Sun Java code signing certificates. Therefore, you must re-sign your code after the expiration of the certificate.

Starfield has a jarsigner-compliant and RFC 3161-compliant free timestamp server. You can read about it at GoDaddy. You may need to install the Starfield root certificate first. It also works with acrobat.

Aloha also has a timestamp server Aloha free timestamp server. You will need to install the Aloaha root certificate first.