Checking the timestamp yourself
Verifying a document
Everything else on the verify page is this product answering a question about its own records. A trusted timestamp is not. An authority nobody here controls signed a statement saying a particular hash existed by a particular moment, and that signature is kept with the record and handed to anybody who asks.
Checking it means you are relying on that authority and on nothing from us.
Getting the token
Check the document at the verify page. Where a token was kept, the answer offers "Download the timestamp token" and the file arrives with a .tst suffix.
Not every signed document has one. Two cases, and the page says which:
- Documents certified before this product began keeping tokens. Their certificates name an authority and a time, and that is our record of it. The token cannot be obtained now, because an authority does not issue a timestamp for a moment that has passed.
- Documents certified while no authority was reachable, or on a deployment that does not use one. Their certificates say so in as many words.
Checking it
The token is over the SHA-256 printed on the certificate, which is the hash of the document as it was presented for signature. It is not the hash of the finished file: a certificate cannot contain a hash of itself.
With OpenSSL, and the authority's own root and intermediate certificates in chain.pem:
openssl ts -verify -digest PASTE_THE_HASH -in downloaded.tst -token_in -CAfile chain.pem
A pass prints "Verification: OK". That tells you the authority signed that hash at the time the token carries, and that neither we nor the sender could have produced it.
Get chain.pem from the authority named on the certificate, not from us. Taking the chain from the party whose claim you are checking would defeat the whole exercise.
What it proves and what it does not
It proves the document existed in that form by that time. It says nothing about who signed it, or whether they were entitled to. Those questions are answered, as far as they can be, by the rest of the certificate, and the limits are set out in what a certificate does and does not establish.