How to Timestamp Signed Software

Learn how to timestamp signed software, configure a trusted timestamp authority, and verify that the timestamp is present. A reliable timestamping workflow helps preserve signature evidence after a code signing certificate expires.

Core workflow: Build → Sign → Timestamp → Verify → Release

Sign softwareCreate the signature with the code signing key

→

Contact a TSARequest trusted time evidence

→

Embed timestampInclude the timestamp token with the artifact

→

Verify and releaseCheck the final signed artifact

→

How Code Signing Timestamping Works

The signing tool creates a signature using the code signing private key, then requests a timestamp from a trusted Time Stamping Authority, commonly called a TSA. The TSA returns a timestamp token that is included with the signed software.

Code signing certificate

Identifies the software publisher and supports verification that signed content has not changed. Its private key is used to create the signature.

Timestamp certificate

Used by the timestamp authority to authenticate its timestamp token. The TSA does not need access to your code signing private key.

Important: Timestamping supports long term signature validation, but it does not make every signature permanently trustworthy. Revocation, compromise, trust chain changes, and platform rules can affect validation.

Why Timestamp Signed Software?

A trusted timestamp provides evidence that a signature was created at a particular time. When software was signed while its certificate was valid, appropriate timestamp information can help the signature remain verifiable after certificate expiration, subject to applicable trust and revocation rules.

Long term signature validation

Helps verifiers establish that signing took place during the certificate's validity period.

Release continuity

Previously released software does not necessarily need to be resigned solely because the signing certificate has expired.

Signature evidence

Provides cryptographic evidence of the signing time alongside the software signature.

Software distribution

Benefits applications that remain available for download and verification for an extended period.

What Is a Timestamp Authority?

A Time Stamping Authority is a trusted service that provides cryptographic evidence of a particular time. The signing tool sends the required signature related information to the TSA, which returns a timestamp token.

The code signing certificate and timestamp certificate have different roles. The code signing certificate is used to create the software signature. The timestamp certificate is used by the TSA to authenticate the timestamp.

RFC 3161 timestamping

Many modern code signing workflows use RFC 3161, a standard protocol for obtaining trusted timestamps. Confirm that your signing tool and timestamp authority support the timestamp format and algorithms required by your software platform. For protocol and policy details, consult the code signing timestamping standards and requirements.

Timestamp Windows Software With SignTool

For Windows software using Authenticode, Microsoft's SignTool can request a timestamp during the signing operation.

Windows commandsigntool sign /fd SHA256 /tr https://timestamp.example.com /td SHA256 /a MyApplication.exe

Parameter	Purpose
`/fd SHA256`	Specifies the file digest algorithm.
`/tr`	Specifies the RFC 3161 timestamp server.
`/td SHA256`	Specifies the digest algorithm used for the timestamp.
`/a`	Allows SignTool to select an appropriate signing certificate.

Before production use: Replace the example timestamp URL with the service configured for your environment. Verify the URL and supported algorithms with the timestamp authority.

Timestamp an existing Windows signature

The correct approach depends on the signing tool and signature format. In most production workflows, request the timestamp during signing rather than trying to add it as a separate post release operation. The command above creates the signature and requests its timestamp in the same operation.

Choose a Certificate for Windows Authenticode Signing

For Windows release workflows, select a code signing certificate that matches your publisher identity and software distribution requirements.

View Microsoft Authenticode certificates

Timestamp Java JAR Files

Java software uses a different signing mechanism from Windows Authenticode. The jarsigner utility supports timestamping through its -tsa option.

Java signing command

jarsigner -keystore mykeystore.jks \
  -tsa https://timestamp.example.com \
  MyApplication.jar \
  my-signing-alias

After signing, verify the JAR:

Verify JAR signaturejarsigner -verify -verbose -certs MyApplication.jar

The exact command depends on the Java version, keystore configuration, and signing identity being used.

Timestamp macOS Software

macOS uses Apple's code signing architecture. The codesign tool can request timestamping as part of the signing process.

Sign and request a timestamp

codesign --force --timestamp \
  --options runtime \
  --sign "Developer ID Application: Your Name" \
  "MyApp.app"

The timestamp is incorporated into the Apple code signature. Verify the signed application after signing:

Verify macOS signaturecodesign --verify --deep --strict --verbose=2 "MyApp.app"

For the Apple platform workflow, follow the macOS application signing process.

Use SHA 256 for Modern Signing Workflows

Modern code signing workflows generally use SHA 256 based hashing rather than older SHA 1 based configurations. For Windows SignTool, the example command uses SHA 256 for both the file digest and timestamp digest.

SHA 256 configuration examplesigntool sign /fd SHA256 /tr https://timestamp.example.com /td SHA256 /a MyApplication.exe

Use algorithms supported by your signing tool, timestamp authority, and target platform. Check the requirements of the specific release environment before standardizing a command.

How to Verify a Timestamp

After signing, verify that the signature contains timestamp information and that the signature and timestamp validate correctly. The exact output varies by platform.

Windows software

signtool verify /pa /v MyApplication.exe

Verbose output can show details about the signature and timestamp. You can also inspect a file's digital signature information in its properties.

Java JAR files

jarsigner -verify -verbose -certs MyApplication.jar

Review the signed JAR and its certificate details.

macOS applications

codesign --display --verbose=4 "MyApp.app"

Inspect signature details using Apple's code signing tools.

Inspect the full trust result

Review the certificate chain, timestamp validity, revocation status, signature integrity, and platform specific trust rules. Do not check only whether a timestamp field exists.

What Happens When a Code Signing Certificate Expires?

A common misconception is that all software signed with an expired code signing certificate automatically becomes invalid. That is not necessarily the case.

If software was signed while the certificate was valid and includes an appropriate trusted timestamp, the timestamp can provide evidence that signing occurred before expiration. However, revocation, compromise, trust chain changes, and platform specific validation rules can affect the result.

What if the certificate was revoked?

Expiration and revocation are different events. Expiration means the certificate reached the end of its validity period. Revocation means trust was withdrawn before or during its normal validity period. A timestamp does not automatically make a signature valid if compromise or the reason for revocation affects its trustworthiness.

Certificate validity

Revocation status

Certificate chain

Timestamp validity

Signature integrity

Platform specific trust rules

Timestamping in CI/CD

Build timestamping into automated signing workflows instead of treating it as a manual release step.

Suggested release flow: Build → Test → Sign → Timestamp → Verify → Package → Release

Sign and timestamp in a Windows pipelinesigntool sign /fd SHA256 /tr https://timestamp.example.com /td SHA256 /a release.exe

Then verify the result:

Verify the release artifactsigntool verify /pa /v release.exe

The same artifact that is timestamped and verified should be the artifact that is released. Keep signing keys protected, restrict signing permissions, and preserve records of released artifacts.

Protect Signing Keys in Automated Releases

If build agents should not hold exportable signing keys, compare protected remote signing options for automated software releases.

Explore cloud code signing

Common Timestamping Problems

Timestamp server unavailable

If the TSA cannot be reached, signing may fail or the result may lack the expected timestamp. Check the timestamp URL, network connectivity, firewall rules, proxy configuration, and TSA availability.

Unsupported timestamp algorithm

The signing tool and timestamp service must support compatible digest and timestamp algorithms. Check their documentation before changing the algorithm.

Signature has no timestamp

A signature can be cryptographically valid while lacking timestamp information. Inspect it with the verification tool appropriate to the platform.

Timestamp validation fails

Possible causes include an invalid timestamp token, an unavailable certificate chain, trust problems, or other validation issues. Inspect the complete signature and timestamp chain.

Best Practices for Timestamped Software

Timestamp during signing

Include timestamping directly in the production signing command whenever possible.

Use a trusted TSA

Choose a timestamp service suitable for your certificate and software distribution workflow.

Use modern digest algorithms

Prefer SHA 256 based configurations where supported by your tools and timestamp authority.

Verify the final artifact

Do not assume a successful signing command proves the timestamp is valid. Verify the exact artifact intended for release.

Keep signing and timestamping separate

The timestamp authority should not receive your code signing private key.

Automate and retain evidence

Add verification to the release pipeline and preserve records of the signed and timestamped artifacts distributed to customers.

Code Signing Timestamp Checklist

Code signing certificate is valid

Private key is protected

Trusted TSA selected

RFC 3161 supported where applicable

SHA 256 signing configured where supported

Timestamp requested during signing

Signature verified

Timestamp verified

Final release artifact unchanged

CI/CD verification configured

Choose the Right Code Signing Certificate

Compare certificate options for your publisher identity, software platform, and release process before signing and timestamping production software.

Browse all code signing certificates

Frequently Asked Questions

What is a code signing timestamp?

A code signing timestamp is cryptographic evidence of when a software signature was created. A trusted Time Stamping Authority provides it.

Why should signed software be timestamped?

Timestamping helps establish that software was signed while its signing certificate was valid and can support continued signature validation after certificate expiration, subject to applicable trust and revocation rules.

Does timestamping extend the code signing certificate?

No. A timestamp does not extend the certificate's validity period. It provides evidence about when the signature was created.

Does a timestamp protect the private key?

No. The code signing private key remains separate from the timestamp service. Private key protection must be handled by the signing infrastructure.

What is RFC 3161 timestamping?

RFC 3161 defines a standard protocol for obtaining trusted timestamps from a Time Stamping Authority.

How do I timestamp an EXE file?

For Windows Authenticode software, SignTool can request an RFC 3161 timestamp during signing with the /tr and /td parameters.

Can Java JAR files be timestamped?

Yes. The Java jarsigner utility supports timestamping through the -tsa option.

Can macOS applications be timestamped?

Yes. Apple's codesign tool can request timestamping during signing with the --timestamp option.

Does timestamping prevent certificate revocation from affecting software?

No. Timestamping does not override certificate revocation or other trust decisions. The circumstances and reason for revocation matter when determining whether a signature remains trusted.

Related Guides for Signing and Verifying Software

Continue with related signing, verification, and release workflow guides.