Signature and Document Timestamps

For SDK requirements and common imports, see Digital Signatures.

The Java SDK exposes three distinct timestamp operations:

Operation	API	Meaning
Embedded signature timestamp	`CPDFDocument.writeSignature(..., tsaUrl)` or PAdES T/LT/LTA creation	A token inside the signature container binds the signature value
Independent document timestamp	`CPDFTimestampService.addDocumentTimestamp()`	A new `ETSI.RFC3161` field protects the PDF revision
Data or digest timestamp token	`timestampData()` / `timestampDigest()`	Returns a DER RFC 3161 token without modifying a PDF

A local signing-time attribute is not a trusted TSA timestamp.

Append a Document Timestamp

A document timestamp uses the TSA's identity and does not require the application's signing private key. It can be appended to the result of two-phase signing.

java

Files.createDirectories(Paths.get("output"));
CPDFTimestampOptions tsa = new CPDFTimestampOptions()
        .setTsaUrl("https://tsa.example.com/timestamp")
        .setTransport(20, 0, "");
CPDFSignatureOptions field = new CPDFSignatureOptions()
        .setFieldName("DocumentTime")
        .setValidationOptions(new CPDFSignatureValidationOptions()
                .setTrustedCertPath("certs/trusted-roots.pem"));
CPDFSignatureCreateResult result = CPDFTimestampService.addDocumentTimestamp(
        "output/external-signed.pdf",
        "output/timestamped.pdf",
        tsa,
        field);
System.out.println("Creation success: " + result.isSuccess());
System.out.println(result.getValidationResult());

The output must be new and different from the input. The current document-timestamp signer uses SHA-256; choosing another digest is explicitly rejected. This operation does not collect DSS/VRI evidence and does not, by itself, establish PAdES-LTA. A TSA failure does not publish a final PDF.

Request a Data or Digest Token

Data and digest requests support SHA-256, SHA-384, and SHA-512. Transport options include timeout, retries, proxy URL, and maximum response size. Request options include policy OID, nonce, and whether certificates should be included.

java

byte[] data = Files.readAllBytes(Paths.get("input.pdf"));
CPDFTimestampOptions options = new CPDFTimestampOptions()
        .setTsaUrl("https://tsa.example.com/timestamp")
        .setDigestAlgorithm(CPDFSignatureDigest.SHA256)
        .setTransport(20, 0, "");
CPDFTimestampResult result = CPDFTimestampService.timestampData(data, options);
if (result.isSuccess()) {
    Files.createDirectories(Paths.get("output"));
    Files.write(Paths.get("output/timestamp-token.der"), result.getTokenDer());
    System.out.println("TSA generation time: " + result.getGenerationTime());
} else {
    System.out.println(result.getErrorCode() + ": " + result.getErrorMessage());
}

If the application already has an imprint, call timestampDigest() with the raw digest bytes and the matching algorithm. That method does not hash the digest again.

A successful TSA response is separate from a certificate-trust verdict. For PDF timestamps, inspect the timestamp imprint, cryptographic signature, and TSA trust-chain items in the full validation report. HTTPS and certificate trust use native OpenSSL configuration rather than the JVM trust store.

See SignatureTimestampTest for embedded timestamps, document timestamps, and both token-request methods.

Signature and Document Timestamps ​

Signature and Document Timestamps