Add a trusted timestamp to your signatures so they stay valid after the signing certificate expires.
A signature without a timestamp is trusted only while the signing certificate is valid. A timestamp from a Time Stamping Authority (TSA) proves the file was signed while the certificate was valid, so operating systems and tools keep trusting the signature after the certificate expires. Always timestamp release builds.
Signing tools on the build machine contact a public RFC 3161 TSA directly. Use the TSA of the CA that issued your certificate where possible. Well-known public TSAs include:
| Provider | URL |
|---|---|
| DigiCert | http://timestamp.digicert.com |
| Sectigo | http://timestamp.sectigo.com |
| Tool | Option | Notes |
|---|---|---|
| SignTool | /tr <URL> /td SHA256 | RFC 3161. Avoid the legacy /t option. |
| jarsigner | -tsa <URL> | |
| JSign | --tsaurl <URL> --tsmode RFC3161 | |
| NuGet | -Timestamper <URL> | |
| Mage | -TimeStampUri <URL> | |
| codesign (macOS) | --timestamp | Uses Apple’s timestamp service |
| apksigner | Not available | APK signatures don’t include timestamps |
| GnuPG | Not available | The signature records its creation time but has no TSA timestamp |
signtool sign /csp "Encryption Consulting Key Storage Provider" /kc <key name> /fd SHA256 /f <certificate file> /tr http://timestamp.digicert.com /td SHA256 setup.exe
Build machines need outbound access to the TSA URL, usually HTTP on TCP 80.
SignTool uses the Windows proxy settings. You can set a machine-wide proxy with netsh winhttp set proxy <proxy:port>.
For Java tools, pass the proxy to the JVM, for example jarsigner -J-Dhttp.proxyHost=proxy.example.com -J-Dhttp.proxyPort=8080 ....
| Tool | Command | Look for |
|---|---|---|
| SignTool | signtool verify /pa /v <file> | “The signature is timestamped:” followed by the date |
| jarsigner | jarsigner -verify -verbose <file.jar> | “Timestamped by” |
| PowerShell | Get-AuthenticodeSignature <file> | Format-List | A TimeStamperCertificate value |
These are a few examples of verification commands for some tools. You can also use other tools to verify a signature of a file.
| Symptom | Cause | Fix |
|---|---|---|
| SignTool: “The specified timestamp server either could not be reached or returned an invalid response.” | The build machine can’t reach the TSA, or the TSA is busy | Check the URL, proxy, and firewall. Retry, or use another TSA. |
| jarsigner: connection or timeout errors when using -tsa | No outbound access or proxy not configured for Java | Pass the proxy settings to the JVM as shown above. |
| The file is signed but not timestamped | The timestamp option was left out | Sign again with the timestamp option. |