Android Guides Timestamps

Digital Signature Timestamps

Signing time can come from the device clock or a timestamp authority (TSA). An embedded timestamp stores the TSA's RFC 3161 token in the signature. Its trustworthiness still requires validation.

Create a Signature with an Embedded Timestamp

Prepare the signature field, appearance, and PKCS12 certificate as described in Create Digital Signatures, then use the writeSignature() overload with tsaUrl.

Here, signatureWidget is a field in the current document, outputPath is a new output path, and tsaUrl is the configured TSA address. Create the output directory first. Run signing on a background thread; TSA access requires android.permission.INTERNET.

java

boolean signed = document.writeSignature(
    signatureWidget,
    outputPath,
    certificatePath,
    certificatePassword,
    "Shanghai",
    "Document approval",
    CPDFDocument.PDFDocMdpP.PDFDocMdpPForbidAllModify,
    tsaUrl
);
if (!signed) {
    // Signing did not complete. Check the certificate, output path, and TSA.
}

kotlin

val signed = document.writeSignature(
    signatureWidget,
    outputPath,
    certificatePath,
    certificatePassword,
    "Shanghai",
    "Document approval",
    CPDFDocument.PDFDocMdpP.PDFDocMdpPForbidAllModify,
    tsaUrl
)
if (!signed) {
    // Signing did not complete. Check the certificate, output path, and TSA.
}

If the TSA is unavailable or rejects the request, signing fails without falling back to a signature without a timestamp. Check the return value. Use the overload without tsaUrl when no embedded timestamp is required.

Starting signing may mark the source document as modified; successful output does not clear that flag. Check the return value and independently open the output file.

Read the Timestamp Source

Open the signed output file and call CPDFSignature.getTimestampSource():

Value	Description
EMBEDDED	The signature contains an embedded timestamp
LOCAL_CLOCK	Only the signer's locally recorded time is available
NONE	No timestamp source is available; also check signature validity

java

for (int i = 0; i < signedDocument.getSignatureCount(); i++) {
    CPDFSignature signature = signedDocument.getPdfSignature(i);
    if (signature != null) {
        CPDFSignature.TimestampSource source = signature.getTimestampSource();
        // Display the timestamp source.
    }
}

kotlin

for (i in 0 until signedDocument.signatureCount) {
    val signature = signedDocument.getPdfSignature(i) ?: continue
    val source = signature.timestampSource
    // Display the timestamp source.
}

Validate the Timestamp

EMBEDDED only indicates presence. Use CPDFSignatureValidator as described in Verify Digital Signatures, enable setCheckTimestamp(true), and configure trusted certificates. Inspect the timestamp checks and TSA chain results.

An embedded timestamp alone does not supply all long-term validation materials. See Long-Term Validation and PAdES Signing to inspect or add those materials.