diff --git a/evidence/time/digicert-2026-11-03/README.md b/evidence/time/digicert-2026-11-03/README.md new file mode 100644 index 0000000..c9479d2 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/README.md @@ -0,0 +1,42 @@ +# Time evidence for three signed cic-primitives release records (2026-11-03) + +RFC 3161 time-stamp tokens from the DigiCert public time-stamp authority over the SHA-256 of the three signed release records `v0.2.1`, `v0.2.0` and `v0.1.5`, obtained on 2026-11-03. + +**Why now.** Every certificate of the signing chain of these records (Developer CA, Source CA, the developer's certificate; the root a few hours later) ends on 2026-12-31 around 13:22 UTC, and the present verifier judges validity at the moment of checking, so from 2027-01-01 it refuses these records. Evidence that a record existed *before* the chain ended has to be made *before* it ends; a token obtained in 2027 would only show a date after the end. See `docs/P5-TRUST-MODEL-PLAN.md` of cic-primitive-forms (section 4). + +| Release | Record SHA-256 | Time stamp (UTC) | +|---|---|---| +| v0.2.1 | `e5d8268aede0d24f02e60a151099a2fdc7615172ed3105b0a05b6b5d19addf63` | 2026-11-03 22:07:48 | +| v0.2.0 | `955fab2d6d9638c773f29fbe97a3279f9f10b9539c4e3e79957df0acef9a57a6` | 2026-11-03 22:09:44 | +| v0.1.5 | `284e44bfcf62d79f782d6cae359c4c99ef2f5297f6f71dcea52a95d28b8c4456` | 2026-11-03 22:09:45 | + +## Check it + +From a clone of cic-primitives that has the full history (the records are read from git at their release commits): + +``` +bash evidence/time/digicert-2026-11-03/verify.sh --selftest +``` + +It reads the time of each stamp **from the token** (the signed time; the manifest value is only compared with it) and runs **every** token check at that time, so a later end of the TSA chain, or the clock of the machine, changes nothing. It checks the trust anchor and the kept CIC certificates against the figures in `manifest.json`, the record against its digest, the token against the request and against the record file, and **that the stamp lies inside the validity of the developer certificate, the Developer CA, the Source CA and the root of the CIC chain**, twice (`openssl verify -attime` over both chains, and plain arithmetic on the dates), and that the kept CIC certificates are the ones the records carry. With `--selftest` it also shows that a record changed by one byte, a wrong anchor, a stamp after the end of the CIC chain, a stamp before it began, a stamp when only some of the CIC certificates are still valid, and a wrong issuer of the developer certificate are all refused. It needs `openssl`, `git` and `python3` with PyYAML, and no network. Exit status 0 only if every check holds. + +## What is here + +* `manifest.json`: for each release the record (commit, path, SHA-256), the request (SHA-256, nonce), the response (SHA-256, status, serial, policy, time, nonce), and the trust anchor with the sources it was checked against. +* `/request.tsq`, `response.tsr`, `tsa-chain.pem`: the request that was sent (70 bytes: algorithm, digest, nonce, "send the TSA certificate"), the reply, and the three certificates the reply carries. +* `cic-chain/`: the four public certificates of the CIC chain that signed the records: developer, Developer CA (**not carried by any record**), Source CA, root. With their validity they are what shows that the stamp was made while the chain was valid. +* `trust-anchor/DigiCert_Trusted_Root_G4.pem`: the **self-signed** DigiCert Trusted Root G4, SHA-256 `55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88`, valid to 2038-01-15. It was taken from the operating system store (an independent source) and its SHA-256, SHA-1 and serial equal those DigiCert publishes. The reply also carries a *cross-signed* copy of this root (valid to 2031); that one is not used as the anchor. + +## What it proves, and what it does not + +It proves that each digest existed **no later than** the stated time, according to the DigiCert time-stamp authority, and that the token is bound to the request that was sent (nonce) and to the exact bytes of the record. + +It does **not** prove who signed the record, that the signature was valid on that day, that the signer was allowed to sign, that the countersignature authorizes anything, that the release is genuine, or that the records were *signed* at that time rather than only existing. It does not replace a trust anchor for the release chain, a revocation rule or a policy (`docs/P5-TRUST-MODEL-PLAN.md`, conditions C1 to C6); it supplies the one piece that could not be made late: independent evidence of existence before the end of the chain. + +## Limits to keep in view + +* The trust in the time rests on DigiCert and on the self-signed root above; the trust anchor was checked against the operating system store and against the publisher's page, not against a third independent party. +* No terms of use for the public endpoint were found (the documentation describes it for code signing and states neither permission nor restriction for other use). Only digests were sent. Another authority needs a new decision. +* The requests were made over plain HTTP (port 443 did not answer from that machine); the replies are signed, so this does not weaken the check. +* OpenSSL `ts -verify` was used; the tokens and the anchor are kept so any other RFC 3161 verifier can be applied later. +* **A second, independent copy of this directory is required by the decision and does not exist yet.** The GitHub repository is one copy; where the second lives is for the owner to name, and it is not recorded here until it exists. diff --git a/evidence/time/digicert-2026-11-03/cic-chain/developer-ca.pem b/evidence/time/digicert-2026-11-03/cic-chain/developer-ca.pem new file mode 100644 index 0000000..e16fc3f --- /dev/null +++ b/evidence/time/digicert-2026-11-03/cic-chain/developer-ca.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICMzCCAdmgAwIBAgIUStyiR+g40cCBauhK8nOUNLIj0iMwCgYIKoZIzj0EAwIw +PjELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNV +BAMMC0NJQyBSb290IENBMB4XDTI2MDMyMDEzMjI0NloXDTI2MTIzMTEzMjI0Nlow +QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV +BAMMEENJQyBEZXZlbG9wZXIgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR7 +529RefaN8Yc+qVHNcNbssh+y5JBlp8lBeRbaWdoP2J0ZzWeHKfehV4Oh04d0J+cd +HLhMA1Ikelhi9B0xJnMeo4GvMIGsMB0GA1UdDgQWBBRefoIdjM9SpTglU/yD45JZ +4NiOFzBnBgNVHSMEYDBegBSiQtbuMt81/vweajD7O4ogMMaKGqFCpEAwPjELMAkG +A1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJ +QyBSb290IENBggIQBDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIB +hjAKBggqhkjOPQQDAgNIADBFAiEAzG5v4TbZRsEjcHFPmcx3R8gIv35ckgBYLdg9 +62uygnQCIBpkfZz/HxqFgsi4VGbjWMfg4xSsWyKfyR//DrgD176X +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/cic-chain/developer.pem b/evidence/time/digicert-2026-11-03/cic-chain/developer.pem new file mode 100644 index 0000000..e9a0650 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/cic-chain/developer.pem @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIICBjCCAaygAwIBAgIUSnRMR6RPnEbg296XWPOqq/u5PCwwCgYIKoZIzj0EAwIw +QzELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxGTAXBgNV +BAMMEENJQyBEZXZlbG9wZXIgQ0EwHhcNMjYwMzIwMTMyMjU5WhcNMjYxMjMxMTMy +MjU5WjBFMQswCQYDVQQGEwJIVTEZMBcGA1UECgwQQ2VudHJhbEluZnJhQ29yZTEb +MBkGA1UEAwwSR2Fib3IgWm9sdGFuIFNpbmtvMFkwEwYHKoZIzj0CAQYIKoZIzj0D +AQcDQgAEIG2CVmTfmLB9pLLclj7YmP2eedAjklpy4LGrU2ijoiy6Xqpuybv7OgJe +i+ez31s65NEV8+X/ByeX1cstR988z6N8MHowCQYDVR0TBAIwADAdBgNVHQ4EFgQU +yZN6AIX/TNnIJ9GwAa/NRN3ujHAwHwYDVR0jBBgwFoAUXn6CHYzPUqU4JVP8g+OS +WeDYjhcwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF +BQcDBDAKBggqhkjOPQQDAgNIADBFAiEA+bFzXRoJ4PCQbhAAtpkcMjt0vNj5rEW0 +lOMBGDNyaWkCIB1vmM7PcZzv/c9bIrxF5kqv6QXomouhByUfeNUTbpKW +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/cic-chain/root.pem b/evidence/time/digicert-2026-11-03/cic-chain/root.pem new file mode 100644 index 0000000..b5de3b1 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/cic-chain/root.pem @@ -0,0 +1,52 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 4100 (0x1004) + Signature Algorithm: ecdsa-with-SHA256 + Issuer: C=HU, O=CentralInfraCore, CN=CIC Root CA + Validity + Not Before: Mar 19 12:59:30 2026 GMT + Not After : Dec 31 23:59:59 2026 GMT + Subject: C=HU, O=CentralInfraCore, CN=CIC Root CA + Subject Public Key Info: + Public Key Algorithm: id-ecPublicKey + Public-Key: (256 bit) + pub: + 04:cd:07:56:3a:e7:28:41:c4:99:76:3a:e8:5e:90: + 39:54:be:e7:7d:42:ab:65:49:05:f0:f8:84:63:5f: + 5f:05:22:56:d1:29:e0:ac:7d:67:e3:cf:ac:8f:9c: + e2:be:71:6f:a8:91:00:e4:6c:af:1f:f2:86:3f:6d: + 03:1d:36:c7:f4 + ASN1 OID: prime256v1 + NIST CURVE: P-256 + X509v3 extensions: + X509v3 Subject Key Identifier: + A2:42:D6:EE:32:DF:35:FE:FC:1E:6A:30:FB:3B:8A:20:30:C6:8A:1A + X509v3 Authority Key Identifier: + keyid:A2:42:D6:EE:32:DF:35:FE:FC:1E:6A:30:FB:3B:8A:20:30:C6:8A:1A + DirName:/C=HU/O=CentralInfraCore/CN=CIC Root CA + serial:10:04 + X509v3 Basic Constraints: critical + CA:TRUE, pathlen:3 + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign + Signature Algorithm: ecdsa-with-SHA256 + Signature Value: + 30:45:02:20:51:b0:f6:e5:50:ac:3b:f8:2e:d1:af:7a:7a:b3: + 42:7b:5d:8e:1d:d0:7d:e0:5c:60:48:42:aa:6b:f0:24:8b:a0: + 02:21:00:d8:c6:94:12:db:f1:a8:b8:3b:45:46:b9:30:88:36: + 6c:f3:e2:56:76:02:35:f6:17:0b:b5:3a:7b:80:5d:16:24 +-----BEGIN CERTIFICATE----- +MIICHDCCAcKgAwIBAgICEAQwCgYIKoZIzj0EAwIwPjELMAkGA1UEBhMCSFUxGTAX +BgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJQyBSb290IENBMB4X +DTI2MDMxOTEyNTkzMFoXDTI2MTIzMTIzNTk1OVowPjELMAkGA1UEBhMCSFUxGTAX +BgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJQyBSb290IENBMFkw +EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzQdWOucoQcSZdjroXpA5VL7nfUKrZUkF +8PiEY19fBSJW0SngrH1n48+sj5zivnFvqJEA5GyvH/KGP20DHTbH9KOBrzCBrDAd +BgNVHQ4EFgQUokLW7jLfNf78Hmow+zuKIDDGihowZwYDVR0jBGAwXoAUokLW7jLf +Nf78Hmow+zuKIDDGihqhQqRAMD4xCzAJBgNVBAYTAkhVMRkwFwYDVQQKDBBDZW50 +cmFsSW5mcmFDb3JlMRQwEgYDVQQDDAtDSUMgUm9vdCBDQYICEAQwEgYDVR0TAQH/ +BAgwBgEB/wIBAzAOBgNVHQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwIDSAAwRQIgUbD2 +5VCsO/gu0a96erNCe12OHdB94FxgSEKqa/Aki6ACIQDYxpQS2/GouDtFRrkwiDZs +8+JWdgI19hcLtTp7gF0WJA== +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/cic-chain/source-ca.pem b/evidence/time/digicert-2026-11-03/cic-chain/source-ca.pem new file mode 100644 index 0000000..27c0e91 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/cic-chain/source-ca.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICMDCCAdagAwIBAgIUStyiR+g40cCBauhK8nOUNLIj0iIwCgYIKoZIzj0EAwIw +PjELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNV +BAMMC0NJQyBSb290IENBMB4XDTI2MDMyMDEzMjIzOVoXDTI2MTIzMTEzMjIzOVow +QDELMAkGA1UEBhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFjAUBgNV +BAMMDUNJQyBTb3VyY2UgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARuSq7+ +gRkRwiZYbZBp8aWzFyK36YMBQ58PwUTtoL6Gzu5QZS2tDGLWvFqDY/BRavqcOfel +I6y+P9WlhntH4oI6o4GvMIGsMB0GA1UdDgQWBBTXWkl+CqRrqaEpr/fUmVHc6B7I +OTBnBgNVHSMEYDBegBSiQtbuMt81/vweajD7O4ogMMaKGqFCpEAwPjELMAkGA1UE +BhMCSFUxGTAXBgNVBAoMEENlbnRyYWxJbmZyYUNvcmUxFDASBgNVBAMMC0NJQyBS +b290IENBggIQBDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAK +BggqhkjOPQQDAgNIADBFAiEA25x0lXd37TAiRROTXQtqXNoMiwl0wCZln3m/DMBR +YcQCID3gc64TnA9Y7QL96lY1nYhAl2NWeMjK8pFXXN2Dymuf +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/manifest.json b/evidence/time/digicert-2026-11-03/manifest.json new file mode 100644 index 0000000..e0472a5 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/manifest.json @@ -0,0 +1,138 @@ +{ + "format": 1, + "what": "RFC 3161 time-stamp tokens over the SHA-256 of three signed cic-primitives release records, obtained from the DigiCert public time-stamp authority on 2026-11-03, before the certificate chain of those records ends on 2026-12-31. A token shows that the digest existed no later than the time it states; it shows nothing about who signed the record or whether the release is genuine.", + "authority": { + "name": "DigiCert public RFC 3161 time-stamp authority", + "endpoint": "http://timestamp.digicert.com", + "transport_note": "plain HTTP (port 443 did not answer from the machine that made the requests); the reply is signed, its integrity does not rest on the transport", + "terms_note": "No terms of use for the public endpoint were found: neither the search nor DigiCert's documentation pages state who may use it or restrict its use; they describe it for code signing. Only a SHA-256 digest, an algorithm identifier, a random nonce and a request for the TSA certificate were sent." + }, + "trust_anchor": { + "file": "trust-anchor/DigiCert_Trusted_Root_G4.pem", + "subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Trusted Root G4 (self-signed)", + "sha256": "55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88", + "sha1": "DD:FB:16:CD:49:31:C9:73:A2:03:7D:3F:C8:3A:4D:7D:77:5D:05:E4", + "serial": "059B1B579E8E2132E23907BDA777755C", + "not_after": "Jan 15 12:00:00 2038 GMT", + "verified_against": [ + { + "source": "operating system store, Ubuntu package ca-certificates 20260816ubuntu0.24.04.1, /usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", + "kind": "independent of the reply" + }, + { + "source": "https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates, entry DigiCert Trusted Root G4 (self-signed), read on 2026-11-03", + "kind": "the publisher's own figures: SHA-256, SHA-1 and serial all equal" + } + ], + "note": "The reply carries a cross-signed DigiCert Trusted Root G4 (issuer DigiCert Assured ID Root CA, valid to 2031-11-09) with the same public key. It is NOT used as the anchor; the self-signed root (valid to 2038-01-15) is." + }, + "stamps": [ + { + "release": "v0.2.1", + "record": { + "git_commit": "5e8c3219b52399e3e764b0b0bb27de710f5445a4", + "path": "release/cic-primitives-v0.2.1.yaml", + "sha256": "e5d8268aede0d24f02e60a151099a2fdc7615172ed3105b0a05b6b5d19addf63", + "bytes": 79011 + }, + "request": { + "file": "v0.2.1/request.tsq", + "sha256": "22a80e66f9b942f5d71a1acb401a9036927425a9ec8e2b0ed6160b28d6bd29d9", + "nonce": "0xEEA25FE7D7899723" + }, + "response": { + "file": "v0.2.1/response.tsr", + "sha256": "d3f4df0465578294b1a58157919462a0d8ec33fd7411b93417e1f7c24d2b5f65", + "status": "Granted", + "serial": "0x675CA92462CD68E87963124F1967FD43", + "policy_oid": "2.16.840.1.114412.7.1", + "stamp_time_utc": "Nov 3 22:07:48 2026 GMT", + "nonce": "0xEEA25FE7D7899723" + }, + "tsa_chain_file": "v0.2.1/tsa-chain.pem" + }, + { + "release": "v0.2.0", + "record": { + "git_commit": "960ee0f048d969a85ad20819bc0f2366ad91fa40", + "path": "release/cic-primitives-v0.2.0.yaml", + "sha256": "955fab2d6d9638c773f29fbe97a3279f9f10b9539c4e3e79957df0acef9a57a6", + "bytes": 64905 + }, + "request": { + "file": "v0.2.0/request.tsq", + "sha256": "1c2b433880a73cc92e9f3511c1066ccf37c872eb1f1c2d817cceb49a293c0a16", + "nonce": "0xF53BC5599CE05F53" + }, + "response": { + "file": "v0.2.0/response.tsr", + "sha256": "4d43ca701ced71f57d3ef78c881553ead52560b0fd75e67131c5e4fc7a1a456e", + "status": "Granted", + "serial": "0x2CD213F94B1638FBFF68D10520DE73E2", + "policy_oid": "2.16.840.1.114412.7.1", + "stamp_time_utc": "Nov 3 22:09:44 2026 GMT", + "nonce": "0xF53BC5599CE05F53" + }, + "tsa_chain_file": "v0.2.0/tsa-chain.pem" + }, + { + "release": "v0.1.5", + "record": { + "git_commit": "d59f7d6b5d22751a932b2bc0a522cf8acec1806b", + "path": "release/cic-primitives-v0.1.5.yaml", + "sha256": "284e44bfcf62d79f782d6cae359c4c99ef2f5297f6f71dcea52a95d28b8c4456", + "bytes": 55002 + }, + "request": { + "file": "v0.1.5/request.tsq", + "sha256": "d403b78ad4f66e53748777753121f33079545c23157a9f4571c66091eeca5fae", + "nonce": "0x2CDA40EE6D7CFA7A" + }, + "response": { + "file": "v0.1.5/response.tsr", + "sha256": "c91b2ad33077fef2806ec11e4ce363d49f102f3426fe7e77f6bd7cf48262ec6e", + "status": "Granted", + "serial": "0x03F23860CF26B3B2F8645FA478CFAAFC", + "policy_oid": "2.16.840.1.114412.7.1", + "stamp_time_utc": "Nov 3 22:09:45 2026 GMT", + "nonce": "0x2CDA40EE6D7CFA7A" + }, + "tsa_chain_file": "v0.1.5/tsa-chain.pem" + } + ], + "cic_chain": { + "developer": { + "file": "cic-chain/developer.pem", + "subject": "C = HU, O = CentralInfraCore, CN = Gabor Zoltan Sinko", + "sha256": "5E:F7:39:DC:91:CF:87:6D:3E:E9:29:DB:94:60:6A:60:A5:80:46:D7:C6:0C:25:EC:93:10:70:83:E9:28:93:03", + "not_before": "Mar 20 13:22:59 2026 GMT", + "not_after": "Dec 31 13:22:59 2026 GMT", + "source": "carried by each of the three records (release.createdBy.certificate); the three records carry the same certificate" + }, + "developer-ca": { + "file": "cic-chain/developer-ca.pem", + "subject": "C = HU, O = CentralInfraCore, CN = CIC Developer CA", + "sha256": "D3:59:D1:47:8F:E9:15:89:FA:02:B7:8A:EC:E3:98:37:DC:0D:60:27:24:B2:6E:0F:4E:4F:86:4B:40:76:F6:6A", + "not_before": "Mar 20 13:22:46 2026 GMT", + "not_after": "Dec 31 13:22:46 2026 GMT", + "source": "NOT carried by the records; a public certificate taken from the owner's local PKI directory (EEC/CICDeveloperCA/CICDeveloperCA2026.pem). That it is the issuer of the developer certificate is shown by openssl verify, not assumed" + }, + "source-ca": { + "file": "cic-chain/source-ca.pem", + "subject": "C = HU, O = CentralInfraCore, CN = CIC Source CA", + "sha256": "27:2B:B9:73:EA:68:4C:C0:00:D6:DF:3E:77:21:25:2C:3C:48:85:BF:93:4E:9A:57:C5:CF:D0:E1:BE:C8:BC:20", + "not_before": "Mar 20 13:22:39 2026 GMT", + "not_after": "Dec 31 13:22:39 2026 GMT", + "source": "carried by each of the three records (cic_countersign.authority.certificate); the same in all three" + }, + "root": { + "file": "cic-chain/root.pem", + "subject": "C = HU, O = CentralInfraCore, CN = CIC Root CA", + "sha256": "7A:87:3A:BB:99:D7:20:D9:77:96:B4:A9:82:30:C4:3A:31:99:3B:7E:67:E3:30:2B:B5:7F:AE:9C:4F:5F:D1:A3", + "not_before": "Mar 19 12:59:30 2026 GMT", + "not_after": "Dec 31 23:59:59 2026 GMT", + "source": "carried by each of the three records (cic_countersign.authority.root_certificate); the same in all three" + }, + "note": "The CIC certificates are public. They are kept because the Developer CA is in none of the records, and because a later check of 'was this signature made while the chain was valid' needs them with the time of the stamp. They are not a trust anchor for the release (docs/P5-TRUST-MODEL-PLAN.md): they say when the chain ended, not whether it may be believed." + } +} diff --git a/evidence/time/digicert-2026-11-03/trust-anchor/DigiCert_Trusted_Root_G4.pem b/evidence/time/digicert-2026-11-03/trust-anchor/DigiCert_Trusted_Root_G4.pem new file mode 100644 index 0000000..4214227 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/trust-anchor/DigiCert_Trusted_Root_G4.pem @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg +RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV +UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu +Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG +SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y +ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If +xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV +ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO +DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ +jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/ +CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi +EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM +fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY +uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK +chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t +9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB +hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD +ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2 +SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd ++SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc +fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa +sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N +cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N +0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie +4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI +r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1 +/YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm +gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+ +-----END CERTIFICATE----- diff --git a/evidence/time/digicert-2026-11-03/v0.1.5/request.tsq b/evidence/time/digicert-2026-11-03/v0.1.5/request.tsq new file mode 100644 index 0000000..6bd7180 Binary files /dev/null and b/evidence/time/digicert-2026-11-03/v0.1.5/request.tsq differ diff --git a/evidence/time/digicert-2026-11-03/v0.1.5/response.tsr b/evidence/time/digicert-2026-11-03/v0.1.5/response.tsr new file mode 100644 index 0000000..ff2b5a5 Binary files /dev/null and b/evidence/time/digicert-2026-11-03/v0.1.5/response.tsr differ diff --git a/evidence/time/digicert-2026-11-03/v0.1.5/tsa-chain.pem b/evidence/time/digicert-2026-11-03/v0.1.5/tsa-chain.pem new file mode 100644 index 0000000..b999d62 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/v0.1.5/tsa-chain.pem @@ -0,0 +1,119 @@ +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert SHA256 RSA4096 Timestamp Responder 2026 1 +issuer=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +-----BEGIN CERTIFICATE----- +MIIG7TCCBNWgAwIBAgIQCE/cM09+RU7bww+P+ZIYNTANBgkqhkiG9w0BAQsFADBp +MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT +OERpZ2lDZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2 +IDIwMjUgQ0ExMB4XDTI2MDgwNTAwMDAwMFoXDTM3MTEwNDIzNTk1OVowYzELMAkG +A1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdp +Q2VydCBTSEEyNTYgUlNBNDA5NiBUaW1lc3RhbXAgUmVzcG9uZGVyIDIwMjYgMTCC +AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALZ7pvLJ/s1K+NSbTGWz/TjG +MPh8CQ6RucZCLv5anHzWJjF/NWJrFIhy24fcpKXlgRiky4WAawDfU3YP0BMxt9l3 +Dm5oCG5Z69AqEN1kgHg2epx+l+lZBcmJCcN0ASURML5uFIS80sZsDwO3BSkUxDjL +JhBI+qiZP3aixAC/qEGLjsBNlLol9VZ7pfGEXiMlneJIC5/YKuizVzNFKZZEeoy/ +0B8Zm+nzKBgSWG52lCO1w+nCg6XpCtklTJXeIg283hw7TmmsZXR+SMbjbrEOvZ3f +P2VxIgeR28Y90ZStd3F9VuA5RVynb/whITPAo9b75Zr4Ta6Mj3URm26QZYMn/Fnb +uTegcoRcFEZ9FOqM5T6MTdtr/n74lIT/ug0eeOzmZ6QTFg33otX+bFRsIolvykE1 +jive4PuESaT8zzVeFWDAMDtozNgLctkGD1ZjkEyZtJrLl5ya0m5doH/ScpaZCZVl +6pNUOCybMc/kxC6EAmSJY24L0yYKD1Nkddsnb/ItVKi/2nXpQNMu1PT5prW83vV8 +d67WowuUs0HdY4H8AMLGvdL/WHEj3ZnqMqAQQP9u3Ai9t+5eQ02GDwy0ODjdzi0x +lp70W+ow63/0++YDEX1M0iwgUHwbrJvfpklkZQvw3+kv3vUPItdwroczk9icflf5 +5W1zOEKAcJVAIXpcMCU9AgMBAAGjggGVMIIBkTAMBgNVHRMBAf8EAjAAMB0GA1Ud +DgQWBBQUyWOKMC7USvtulPPm40B+9ezN4jAfBgNVHSMEGDAWgBTvb1NK6eQGfHrK +4pBW9i/USezLTjAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +AwgwgZUGCCsGAQUFBwEBBIGIMIGFMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5k +aWdpY2VydC5jb20wXQYIKwYBBQUHMAKGUWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0 +LmNvbS9EaWdpQ2VydFRydXN0ZWRHNFRpbWVTdGFtcGluZ1JTQTQwOTZTSEEyNTYy +MDI1Q0ExLmNydDBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vY3JsMy5kaWdpY2Vy +dC5jb20vRGlnaUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBpbmdSU0E0MDk2U0hBMjU2 +MjAyNUNBMS5jcmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0G +CSqGSIb3DQEBCwUAA4ICAQCNxTphHp1SCt+ZrAmAfn0oQLFr0mLywSLaDXQIENoy +KqxrFbJblzCVP/pkXmwXOdrOpWygLzlT12os5ipDCy35RBCg2UMeApEtrfGhz45F +4Wt4WGdNdIbRWt3YTYJmpR+b7lr4d7Uwn+H600u4D7RnOGf8Wj4UNgAdZkfHhHv1 +mx9EVh71SJelcEN/oORSjXzdjfw1iZH9d8Nh/thn6hH23d+VsPAr6GAYyzSA02nX +D1nYLI7Ijmiv+xLCiYC41DSFYL3GhTiy0PxpawPtGRyaBVGzq+UiTfM8pD7KVyF5 +aQyWP4KhVGUUTnmm/RlYJoW3TiXA/+t0YcT2oRVBm3JETjajHug2AL+v5jhtKVnd +3D0rbHXEu27o+Q8p4sEWPMqKDB+qbceb6T/6WcwTwXmQ9lOCLLYcsQeSWmvKqzpA +ec9etE14jOQAzLKWdE3w/TCaKtLRaRT7LCkRYVnhA2D73FLje1O5b3HR5eHs0NzU +/+xX7NbEdcofy0W3Wdwd1XOqtlpg/JgwtKfZM5dqO94lbUveOiJBI+xZEbGRsMNb +XmMREUTgu+Oca7Y73MPWcslIx2VhkSKSXjDbD6rgg39H5Mh7QfieAIjWagkJNt68 +Yfim6cjEzVSiLSeZfdkr5dtFPTW6jATlWJdYeeDRGCyatf8R1hSjzSvdN8yWQPT9 +gw== +-----END CERTIFICATE----- + +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +-----BEGIN CERTIFICATE----- +MIIGtDCCBJygAwIBAgIQDcesVwX/IZkuQEMiDDpJhjANBgkqhkiG9w0BAQsFADBi +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg +RzQwHhcNMjUwNTA3MDAwMDAwWhcNMzgwMTE0MjM1OTU5WjBpMQswCQYDVQQGEwJV +UzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRy +dXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0ExMIIC +IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtHgx0wqYQXK+PEbAHKx126NG +aHS0URedTa2NDZS1mZaDLFTtQ2oRjzUXMmxCqvkbsDpz4aH+qbxeLho8I6jY3xL1 +IusLopuW2qftJYJaDNs1+JH7Z+QdSKWM06qchUP+AbdJgMQB3h2DZ0Mal5kYp77j +YMVQXSZH++0trj6Ao+xh/AS7sQRuQL37QXbDhAktVJMQbzIBHYJBYgzWIjk8eDrY +hXDEpKk7RdoX0M980EpLtlrNyHw0Xm+nt5pnYJU3Gmq6bNMI1I7Gb5IBZK4ivbVC +iZv7PNBYqHEpNVWC2ZQ8BbfnFRQVESYOszFI2Wv82wnJRfN20VRS3hpLgIR4hjzL +0hpoYGk81coWJ+KdPvMvaB0WkE/2qHxJ0ucS638ZxqU14lDnki7CcoKCz6eum5A1 +9WZQHkqUJfdkDjHkccpL6uoG8pbF0LJAQQZxst7VvwDDjAmSFTUms+wV/FbWBqi7 +fTJnjq3hj0XbQcd8hjj/q8d6ylgxCZSKi17yVp2NL+cnT6Toy+rN+nM8M7LnLqCr +O2JP3oW//1sfuZDKiDEb1AQ8es9Xr/u6bDTnYCTKIsDq1BtmXUqEG1NqzJKS4kOm +xkYp2WyODi7vQTCBZtVFJfVZ3j7OgWmnhFr4yUozZtqgPrHRVHhGNKlYzyjlroPx +ul+bgIspzOwbtmsgY1MCAwEAAaOCAV0wggFZMBIGA1UdEwEB/wQIMAYBAf8CAQAw +HQYDVR0OBBYEFO9vU0rp5AZ8esrikFb2L9RJ7MtOMB8GA1UdIwQYMBaAFOzX44LS +cV1kTN8uZz/nupiuHA9PMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEF +BQcDCDB3BggrBgEFBQcBAQRrMGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRp +Z2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1aHR0cDovL2NhY2VydHMuZGlnaWNlcnQu +Y29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcnQwQwYDVR0fBDwwOjA4oDagNIYy +aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5j +cmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEB +CwUAA4ICAQAXzvsWgBz+Bz0RdnEwvb4LyLU0pn/N0IfFiBowf0/Dm1wGc/Do7oVM +Y2mhXZXjDNJQa8j00DNqhCT3t+s8G0iP5kvN2n7Jd2E4/iEIUBO41P5F448rSYJ5 +9Ib61eoalhnd6ywFLerycvZTAz40y8S4F3/a+Z1jEMK/DMm/axFSgoR8n6c3nuZB +9BfBwAQYK9FHaoq2e26MHvVY9gCDA/JYsq7pGdogP8HRtrYfctSLANEBfHU16r3J +05qX3kId+ZOczgj5kjatVB+NdADVZKON/gnZruMvNYY2o1f4MXRJDMdTSlOLh0HC +n2cQLwQCqjFbqrXuvTPSegOOzr4EWj7PtspIHBldNE2K9i697cvaiIo2p61Ed2p8 +xMJb82Yosn0z4y25xUbI7GIN/TpVfHIqQ6Ku/qjTY6hc3hsXMrS+U0yy+GWqAXam +4ToWd2UQ1KYT70kZjE4YtL8Pbzg0c1ugMZyZZd/BdHLiRu7hAWE6bTEm4XYRkA6T +l4KSFLFk43esaUeqGkH/wyW4N7OigizwJWeukcyIPbAvjSabnf7+Pu0VrFgoiovR +Diyx3zEdmcif/sYQsfch28bZeUz2rtY/9TCA6TD8dC3JE3rYkrhLULy7Dc90G6e8 +BlqmyIjlgp2+VqsS9/wQD7yFylIz0scmbKvFoW2jNrbM1pD2T7m3XA== +-----END CERTIFICATE----- + +subject=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root CA +-----BEGIN CERTIFICATE----- +MIIFjTCCBHWgAwIBAgIQDpsYjvnQLefv21DiCEAYWjANBgkqhkiG9w0BAQwFADBl +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv +b3QgQ0EwHhcNMjIwODAxMDAwMDAwWhcNMzExMTA5MjM1OTU5WjBiMQswCQYDVQQG +EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl +cnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0G +CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7J +IT3yithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxS +D1Ifxp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb +7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1ef +VFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoY +OAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSa +M0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI +8OCiEhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9L +BADMfRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfm +Q6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDr +McXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15Gkv +mB0t9dmpsh3lGwIDAQABo4IBOjCCATYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E +FgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGL +p6chnfNtyA8wDgYDVR0PAQH/BAQDAgGGMHkGCCsGAQUFBwEBBG0wazAkBggrBgEF +BQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUFBzAChjdodHRw +Oi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu +Y3J0MEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E +aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwEQYDVR0gBAowCDAGBgRVHSAAMA0G +CSqGSIb3DQEBDAUAA4IBAQBwoL9DXFXnOF+go3QbPbYW1/e/Vwe9mqyhhyzshV6p +Grsi+IcaaVQi7aSId229GhT0E0p6Ly23OO/0/4C5+KH38nLeJLxSA8hO0Cre+i1W +z/n096wwepqLsl7Uz9FDRJtDIeuWcqFItJnLnU+nBgMTdydE1Od/6Fmo8L8vC6bp +8jQ87PcDx4eo0kxAGTVGamlUsLihVo7spNU96LHc/RzY9HdaXFSMb++hUD38dglo +hJ9vytsgjTVgHAIDyyCwrFigDkBjxZgiwbJZ9VVrzyerbHbObyMt9H5xaiNrIv8S +uFQtJ37YOtnwtoeW/VvRXKwYw02fc7cBqZ9Xql4o4rmU +-----END CERTIFICATE----- + diff --git a/evidence/time/digicert-2026-11-03/v0.2.0/request.tsq b/evidence/time/digicert-2026-11-03/v0.2.0/request.tsq new file mode 100644 index 0000000..c3364fa Binary files /dev/null and b/evidence/time/digicert-2026-11-03/v0.2.0/request.tsq differ diff --git a/evidence/time/digicert-2026-11-03/v0.2.0/response.tsr b/evidence/time/digicert-2026-11-03/v0.2.0/response.tsr new file mode 100644 index 0000000..58aadc5 Binary files /dev/null and b/evidence/time/digicert-2026-11-03/v0.2.0/response.tsr differ diff --git a/evidence/time/digicert-2026-11-03/v0.2.0/tsa-chain.pem b/evidence/time/digicert-2026-11-03/v0.2.0/tsa-chain.pem new file mode 100644 index 0000000..b999d62 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/v0.2.0/tsa-chain.pem @@ -0,0 +1,119 @@ +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert SHA256 RSA4096 Timestamp Responder 2026 1 +issuer=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +-----BEGIN CERTIFICATE----- +MIIG7TCCBNWgAwIBAgIQCE/cM09+RU7bww+P+ZIYNTANBgkqhkiG9w0BAQsFADBp +MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT +OERpZ2lDZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2 +IDIwMjUgQ0ExMB4XDTI2MDgwNTAwMDAwMFoXDTM3MTEwNDIzNTk1OVowYzELMAkG +A1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdp +Q2VydCBTSEEyNTYgUlNBNDA5NiBUaW1lc3RhbXAgUmVzcG9uZGVyIDIwMjYgMTCC +AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALZ7pvLJ/s1K+NSbTGWz/TjG +MPh8CQ6RucZCLv5anHzWJjF/NWJrFIhy24fcpKXlgRiky4WAawDfU3YP0BMxt9l3 +Dm5oCG5Z69AqEN1kgHg2epx+l+lZBcmJCcN0ASURML5uFIS80sZsDwO3BSkUxDjL +JhBI+qiZP3aixAC/qEGLjsBNlLol9VZ7pfGEXiMlneJIC5/YKuizVzNFKZZEeoy/ +0B8Zm+nzKBgSWG52lCO1w+nCg6XpCtklTJXeIg283hw7TmmsZXR+SMbjbrEOvZ3f +P2VxIgeR28Y90ZStd3F9VuA5RVynb/whITPAo9b75Zr4Ta6Mj3URm26QZYMn/Fnb +uTegcoRcFEZ9FOqM5T6MTdtr/n74lIT/ug0eeOzmZ6QTFg33otX+bFRsIolvykE1 +jive4PuESaT8zzVeFWDAMDtozNgLctkGD1ZjkEyZtJrLl5ya0m5doH/ScpaZCZVl +6pNUOCybMc/kxC6EAmSJY24L0yYKD1Nkddsnb/ItVKi/2nXpQNMu1PT5prW83vV8 +d67WowuUs0HdY4H8AMLGvdL/WHEj3ZnqMqAQQP9u3Ai9t+5eQ02GDwy0ODjdzi0x +lp70W+ow63/0++YDEX1M0iwgUHwbrJvfpklkZQvw3+kv3vUPItdwroczk9icflf5 +5W1zOEKAcJVAIXpcMCU9AgMBAAGjggGVMIIBkTAMBgNVHRMBAf8EAjAAMB0GA1Ud +DgQWBBQUyWOKMC7USvtulPPm40B+9ezN4jAfBgNVHSMEGDAWgBTvb1NK6eQGfHrK +4pBW9i/USezLTjAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +AwgwgZUGCCsGAQUFBwEBBIGIMIGFMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5k +aWdpY2VydC5jb20wXQYIKwYBBQUHMAKGUWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0 +LmNvbS9EaWdpQ2VydFRydXN0ZWRHNFRpbWVTdGFtcGluZ1JTQTQwOTZTSEEyNTYy +MDI1Q0ExLmNydDBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vY3JsMy5kaWdpY2Vy +dC5jb20vRGlnaUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBpbmdSU0E0MDk2U0hBMjU2 +MjAyNUNBMS5jcmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0G +CSqGSIb3DQEBCwUAA4ICAQCNxTphHp1SCt+ZrAmAfn0oQLFr0mLywSLaDXQIENoy +KqxrFbJblzCVP/pkXmwXOdrOpWygLzlT12os5ipDCy35RBCg2UMeApEtrfGhz45F +4Wt4WGdNdIbRWt3YTYJmpR+b7lr4d7Uwn+H600u4D7RnOGf8Wj4UNgAdZkfHhHv1 +mx9EVh71SJelcEN/oORSjXzdjfw1iZH9d8Nh/thn6hH23d+VsPAr6GAYyzSA02nX +D1nYLI7Ijmiv+xLCiYC41DSFYL3GhTiy0PxpawPtGRyaBVGzq+UiTfM8pD7KVyF5 +aQyWP4KhVGUUTnmm/RlYJoW3TiXA/+t0YcT2oRVBm3JETjajHug2AL+v5jhtKVnd +3D0rbHXEu27o+Q8p4sEWPMqKDB+qbceb6T/6WcwTwXmQ9lOCLLYcsQeSWmvKqzpA +ec9etE14jOQAzLKWdE3w/TCaKtLRaRT7LCkRYVnhA2D73FLje1O5b3HR5eHs0NzU +/+xX7NbEdcofy0W3Wdwd1XOqtlpg/JgwtKfZM5dqO94lbUveOiJBI+xZEbGRsMNb +XmMREUTgu+Oca7Y73MPWcslIx2VhkSKSXjDbD6rgg39H5Mh7QfieAIjWagkJNt68 +Yfim6cjEzVSiLSeZfdkr5dtFPTW6jATlWJdYeeDRGCyatf8R1hSjzSvdN8yWQPT9 +gw== +-----END CERTIFICATE----- + +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +-----BEGIN CERTIFICATE----- +MIIGtDCCBJygAwIBAgIQDcesVwX/IZkuQEMiDDpJhjANBgkqhkiG9w0BAQsFADBi +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg +RzQwHhcNMjUwNTA3MDAwMDAwWhcNMzgwMTE0MjM1OTU5WjBpMQswCQYDVQQGEwJV +UzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRy +dXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0ExMIIC +IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtHgx0wqYQXK+PEbAHKx126NG +aHS0URedTa2NDZS1mZaDLFTtQ2oRjzUXMmxCqvkbsDpz4aH+qbxeLho8I6jY3xL1 +IusLopuW2qftJYJaDNs1+JH7Z+QdSKWM06qchUP+AbdJgMQB3h2DZ0Mal5kYp77j +YMVQXSZH++0trj6Ao+xh/AS7sQRuQL37QXbDhAktVJMQbzIBHYJBYgzWIjk8eDrY +hXDEpKk7RdoX0M980EpLtlrNyHw0Xm+nt5pnYJU3Gmq6bNMI1I7Gb5IBZK4ivbVC +iZv7PNBYqHEpNVWC2ZQ8BbfnFRQVESYOszFI2Wv82wnJRfN20VRS3hpLgIR4hjzL +0hpoYGk81coWJ+KdPvMvaB0WkE/2qHxJ0ucS638ZxqU14lDnki7CcoKCz6eum5A1 +9WZQHkqUJfdkDjHkccpL6uoG8pbF0LJAQQZxst7VvwDDjAmSFTUms+wV/FbWBqi7 +fTJnjq3hj0XbQcd8hjj/q8d6ylgxCZSKi17yVp2NL+cnT6Toy+rN+nM8M7LnLqCr +O2JP3oW//1sfuZDKiDEb1AQ8es9Xr/u6bDTnYCTKIsDq1BtmXUqEG1NqzJKS4kOm +xkYp2WyODi7vQTCBZtVFJfVZ3j7OgWmnhFr4yUozZtqgPrHRVHhGNKlYzyjlroPx +ul+bgIspzOwbtmsgY1MCAwEAAaOCAV0wggFZMBIGA1UdEwEB/wQIMAYBAf8CAQAw +HQYDVR0OBBYEFO9vU0rp5AZ8esrikFb2L9RJ7MtOMB8GA1UdIwQYMBaAFOzX44LS +cV1kTN8uZz/nupiuHA9PMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEF +BQcDCDB3BggrBgEFBQcBAQRrMGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRp +Z2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1aHR0cDovL2NhY2VydHMuZGlnaWNlcnQu +Y29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcnQwQwYDVR0fBDwwOjA4oDagNIYy +aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5j +cmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEB +CwUAA4ICAQAXzvsWgBz+Bz0RdnEwvb4LyLU0pn/N0IfFiBowf0/Dm1wGc/Do7oVM +Y2mhXZXjDNJQa8j00DNqhCT3t+s8G0iP5kvN2n7Jd2E4/iEIUBO41P5F448rSYJ5 +9Ib61eoalhnd6ywFLerycvZTAz40y8S4F3/a+Z1jEMK/DMm/axFSgoR8n6c3nuZB +9BfBwAQYK9FHaoq2e26MHvVY9gCDA/JYsq7pGdogP8HRtrYfctSLANEBfHU16r3J +05qX3kId+ZOczgj5kjatVB+NdADVZKON/gnZruMvNYY2o1f4MXRJDMdTSlOLh0HC +n2cQLwQCqjFbqrXuvTPSegOOzr4EWj7PtspIHBldNE2K9i697cvaiIo2p61Ed2p8 +xMJb82Yosn0z4y25xUbI7GIN/TpVfHIqQ6Ku/qjTY6hc3hsXMrS+U0yy+GWqAXam +4ToWd2UQ1KYT70kZjE4YtL8Pbzg0c1ugMZyZZd/BdHLiRu7hAWE6bTEm4XYRkA6T +l4KSFLFk43esaUeqGkH/wyW4N7OigizwJWeukcyIPbAvjSabnf7+Pu0VrFgoiovR +Diyx3zEdmcif/sYQsfch28bZeUz2rtY/9TCA6TD8dC3JE3rYkrhLULy7Dc90G6e8 +BlqmyIjlgp2+VqsS9/wQD7yFylIz0scmbKvFoW2jNrbM1pD2T7m3XA== +-----END CERTIFICATE----- + +subject=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root CA +-----BEGIN CERTIFICATE----- +MIIFjTCCBHWgAwIBAgIQDpsYjvnQLefv21DiCEAYWjANBgkqhkiG9w0BAQwFADBl +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv +b3QgQ0EwHhcNMjIwODAxMDAwMDAwWhcNMzExMTA5MjM1OTU5WjBiMQswCQYDVQQG +EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl +cnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0G +CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7J +IT3yithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxS +D1Ifxp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb +7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1ef +VFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoY +OAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSa +M0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI +8OCiEhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9L +BADMfRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfm +Q6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDr +McXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15Gkv +mB0t9dmpsh3lGwIDAQABo4IBOjCCATYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E +FgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGL +p6chnfNtyA8wDgYDVR0PAQH/BAQDAgGGMHkGCCsGAQUFBwEBBG0wazAkBggrBgEF +BQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUFBzAChjdodHRw +Oi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu +Y3J0MEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E +aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwEQYDVR0gBAowCDAGBgRVHSAAMA0G +CSqGSIb3DQEBDAUAA4IBAQBwoL9DXFXnOF+go3QbPbYW1/e/Vwe9mqyhhyzshV6p +Grsi+IcaaVQi7aSId229GhT0E0p6Ly23OO/0/4C5+KH38nLeJLxSA8hO0Cre+i1W +z/n096wwepqLsl7Uz9FDRJtDIeuWcqFItJnLnU+nBgMTdydE1Od/6Fmo8L8vC6bp +8jQ87PcDx4eo0kxAGTVGamlUsLihVo7spNU96LHc/RzY9HdaXFSMb++hUD38dglo +hJ9vytsgjTVgHAIDyyCwrFigDkBjxZgiwbJZ9VVrzyerbHbObyMt9H5xaiNrIv8S +uFQtJ37YOtnwtoeW/VvRXKwYw02fc7cBqZ9Xql4o4rmU +-----END CERTIFICATE----- + diff --git a/evidence/time/digicert-2026-11-03/v0.2.1/request.tsq b/evidence/time/digicert-2026-11-03/v0.2.1/request.tsq new file mode 100644 index 0000000..41f5a7e Binary files /dev/null and b/evidence/time/digicert-2026-11-03/v0.2.1/request.tsq differ diff --git a/evidence/time/digicert-2026-11-03/v0.2.1/response.tsr b/evidence/time/digicert-2026-11-03/v0.2.1/response.tsr new file mode 100644 index 0000000..e72c5c2 Binary files /dev/null and b/evidence/time/digicert-2026-11-03/v0.2.1/response.tsr differ diff --git a/evidence/time/digicert-2026-11-03/v0.2.1/tsa-chain.pem b/evidence/time/digicert-2026-11-03/v0.2.1/tsa-chain.pem new file mode 100644 index 0000000..b999d62 --- /dev/null +++ b/evidence/time/digicert-2026-11-03/v0.2.1/tsa-chain.pem @@ -0,0 +1,119 @@ +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert SHA256 RSA4096 Timestamp Responder 2026 1 +issuer=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +-----BEGIN CERTIFICATE----- +MIIG7TCCBNWgAwIBAgIQCE/cM09+RU7bww+P+ZIYNTANBgkqhkiG9w0BAQsFADBp +MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMT +OERpZ2lDZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2 +IDIwMjUgQ0ExMB4XDTI2MDgwNTAwMDAwMFoXDTM3MTEwNDIzNTk1OVowYzELMAkG +A1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdp +Q2VydCBTSEEyNTYgUlNBNDA5NiBUaW1lc3RhbXAgUmVzcG9uZGVyIDIwMjYgMTCC +AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALZ7pvLJ/s1K+NSbTGWz/TjG +MPh8CQ6RucZCLv5anHzWJjF/NWJrFIhy24fcpKXlgRiky4WAawDfU3YP0BMxt9l3 +Dm5oCG5Z69AqEN1kgHg2epx+l+lZBcmJCcN0ASURML5uFIS80sZsDwO3BSkUxDjL +JhBI+qiZP3aixAC/qEGLjsBNlLol9VZ7pfGEXiMlneJIC5/YKuizVzNFKZZEeoy/ +0B8Zm+nzKBgSWG52lCO1w+nCg6XpCtklTJXeIg283hw7TmmsZXR+SMbjbrEOvZ3f +P2VxIgeR28Y90ZStd3F9VuA5RVynb/whITPAo9b75Zr4Ta6Mj3URm26QZYMn/Fnb +uTegcoRcFEZ9FOqM5T6MTdtr/n74lIT/ug0eeOzmZ6QTFg33otX+bFRsIolvykE1 +jive4PuESaT8zzVeFWDAMDtozNgLctkGD1ZjkEyZtJrLl5ya0m5doH/ScpaZCZVl +6pNUOCybMc/kxC6EAmSJY24L0yYKD1Nkddsnb/ItVKi/2nXpQNMu1PT5prW83vV8 +d67WowuUs0HdY4H8AMLGvdL/WHEj3ZnqMqAQQP9u3Ai9t+5eQ02GDwy0ODjdzi0x +lp70W+ow63/0++YDEX1M0iwgUHwbrJvfpklkZQvw3+kv3vUPItdwroczk9icflf5 +5W1zOEKAcJVAIXpcMCU9AgMBAAGjggGVMIIBkTAMBgNVHRMBAf8EAjAAMB0GA1Ud +DgQWBBQUyWOKMC7USvtulPPm40B+9ezN4jAfBgNVHSMEGDAWgBTvb1NK6eQGfHrK +4pBW9i/USezLTjAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +AwgwgZUGCCsGAQUFBwEBBIGIMIGFMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5k +aWdpY2VydC5jb20wXQYIKwYBBQUHMAKGUWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0 +LmNvbS9EaWdpQ2VydFRydXN0ZWRHNFRpbWVTdGFtcGluZ1JTQTQwOTZTSEEyNTYy +MDI1Q0ExLmNydDBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vY3JsMy5kaWdpY2Vy +dC5jb20vRGlnaUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBpbmdSU0E0MDk2U0hBMjU2 +MjAyNUNBMS5jcmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0G +CSqGSIb3DQEBCwUAA4ICAQCNxTphHp1SCt+ZrAmAfn0oQLFr0mLywSLaDXQIENoy +KqxrFbJblzCVP/pkXmwXOdrOpWygLzlT12os5ipDCy35RBCg2UMeApEtrfGhz45F +4Wt4WGdNdIbRWt3YTYJmpR+b7lr4d7Uwn+H600u4D7RnOGf8Wj4UNgAdZkfHhHv1 +mx9EVh71SJelcEN/oORSjXzdjfw1iZH9d8Nh/thn6hH23d+VsPAr6GAYyzSA02nX +D1nYLI7Ijmiv+xLCiYC41DSFYL3GhTiy0PxpawPtGRyaBVGzq+UiTfM8pD7KVyF5 +aQyWP4KhVGUUTnmm/RlYJoW3TiXA/+t0YcT2oRVBm3JETjajHug2AL+v5jhtKVnd +3D0rbHXEu27o+Q8p4sEWPMqKDB+qbceb6T/6WcwTwXmQ9lOCLLYcsQeSWmvKqzpA +ec9etE14jOQAzLKWdE3w/TCaKtLRaRT7LCkRYVnhA2D73FLje1O5b3HR5eHs0NzU +/+xX7NbEdcofy0W3Wdwd1XOqtlpg/JgwtKfZM5dqO94lbUveOiJBI+xZEbGRsMNb +XmMREUTgu+Oca7Y73MPWcslIx2VhkSKSXjDbD6rgg39H5Mh7QfieAIjWagkJNt68 +Yfim6cjEzVSiLSeZfdkr5dtFPTW6jATlWJdYeeDRGCyatf8R1hSjzSvdN8yWQPT9 +gw== +-----END CERTIFICATE----- + +subject=C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +-----BEGIN CERTIFICATE----- +MIIGtDCCBJygAwIBAgIQDcesVwX/IZkuQEMiDDpJhjANBgkqhkiG9w0BAQsFADBi +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg +RzQwHhcNMjUwNTA3MDAwMDAwWhcNMzgwMTE0MjM1OTU5WjBpMQswCQYDVQQGEwJV +UzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRy +dXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0ExMIIC +IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtHgx0wqYQXK+PEbAHKx126NG +aHS0URedTa2NDZS1mZaDLFTtQ2oRjzUXMmxCqvkbsDpz4aH+qbxeLho8I6jY3xL1 +IusLopuW2qftJYJaDNs1+JH7Z+QdSKWM06qchUP+AbdJgMQB3h2DZ0Mal5kYp77j +YMVQXSZH++0trj6Ao+xh/AS7sQRuQL37QXbDhAktVJMQbzIBHYJBYgzWIjk8eDrY +hXDEpKk7RdoX0M980EpLtlrNyHw0Xm+nt5pnYJU3Gmq6bNMI1I7Gb5IBZK4ivbVC +iZv7PNBYqHEpNVWC2ZQ8BbfnFRQVESYOszFI2Wv82wnJRfN20VRS3hpLgIR4hjzL +0hpoYGk81coWJ+KdPvMvaB0WkE/2qHxJ0ucS638ZxqU14lDnki7CcoKCz6eum5A1 +9WZQHkqUJfdkDjHkccpL6uoG8pbF0LJAQQZxst7VvwDDjAmSFTUms+wV/FbWBqi7 +fTJnjq3hj0XbQcd8hjj/q8d6ylgxCZSKi17yVp2NL+cnT6Toy+rN+nM8M7LnLqCr +O2JP3oW//1sfuZDKiDEb1AQ8es9Xr/u6bDTnYCTKIsDq1BtmXUqEG1NqzJKS4kOm +xkYp2WyODi7vQTCBZtVFJfVZ3j7OgWmnhFr4yUozZtqgPrHRVHhGNKlYzyjlroPx +ul+bgIspzOwbtmsgY1MCAwEAAaOCAV0wggFZMBIGA1UdEwEB/wQIMAYBAf8CAQAw +HQYDVR0OBBYEFO9vU0rp5AZ8esrikFb2L9RJ7MtOMB8GA1UdIwQYMBaAFOzX44LS +cV1kTN8uZz/nupiuHA9PMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEF +BQcDCDB3BggrBgEFBQcBAQRrMGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRp +Z2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1aHR0cDovL2NhY2VydHMuZGlnaWNlcnQu +Y29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcnQwQwYDVR0fBDwwOjA4oDagNIYy +aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5j +cmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEB +CwUAA4ICAQAXzvsWgBz+Bz0RdnEwvb4LyLU0pn/N0IfFiBowf0/Dm1wGc/Do7oVM +Y2mhXZXjDNJQa8j00DNqhCT3t+s8G0iP5kvN2n7Jd2E4/iEIUBO41P5F448rSYJ5 +9Ib61eoalhnd6ywFLerycvZTAz40y8S4F3/a+Z1jEMK/DMm/axFSgoR8n6c3nuZB +9BfBwAQYK9FHaoq2e26MHvVY9gCDA/JYsq7pGdogP8HRtrYfctSLANEBfHU16r3J +05qX3kId+ZOczgj5kjatVB+NdADVZKON/gnZruMvNYY2o1f4MXRJDMdTSlOLh0HC +n2cQLwQCqjFbqrXuvTPSegOOzr4EWj7PtspIHBldNE2K9i697cvaiIo2p61Ed2p8 +xMJb82Yosn0z4y25xUbI7GIN/TpVfHIqQ6Ku/qjTY6hc3hsXMrS+U0yy+GWqAXam +4ToWd2UQ1KYT70kZjE4YtL8Pbzg0c1ugMZyZZd/BdHLiRu7hAWE6bTEm4XYRkA6T +l4KSFLFk43esaUeqGkH/wyW4N7OigizwJWeukcyIPbAvjSabnf7+Pu0VrFgoiovR +Diyx3zEdmcif/sYQsfch28bZeUz2rtY/9TCA6TD8dC3JE3rYkrhLULy7Dc90G6e8 +BlqmyIjlgp2+VqsS9/wQD7yFylIz0scmbKvFoW2jNrbM1pD2T7m3XA== +-----END CERTIFICATE----- + +subject=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Trusted Root G4 +issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Assured ID Root CA +-----BEGIN CERTIFICATE----- +MIIFjTCCBHWgAwIBAgIQDpsYjvnQLefv21DiCEAYWjANBgkqhkiG9w0BAQwFADBl +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv +b3QgQ0EwHhcNMjIwODAxMDAwMDAwWhcNMzExMTA5MjM1OTU5WjBiMQswCQYDVQQG +EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl +cnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0G +CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7J +IT3yithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxS +D1Ifxp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb +7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1ef +VFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoY +OAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSa +M0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI +8OCiEhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9L +BADMfRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfm +Q6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDr +McXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15Gkv +mB0t9dmpsh3lGwIDAQABo4IBOjCCATYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E +FgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGL +p6chnfNtyA8wDgYDVR0PAQH/BAQDAgGGMHkGCCsGAQUFBwEBBG0wazAkBggrBgEF +BQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUFBzAChjdodHRw +Oi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu +Y3J0MEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9E +aWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwEQYDVR0gBAowCDAGBgRVHSAAMA0G +CSqGSIb3DQEBDAUAA4IBAQBwoL9DXFXnOF+go3QbPbYW1/e/Vwe9mqyhhyzshV6p +Grsi+IcaaVQi7aSId229GhT0E0p6Ly23OO/0/4C5+KH38nLeJLxSA8hO0Cre+i1W +z/n096wwepqLsl7Uz9FDRJtDIeuWcqFItJnLnU+nBgMTdydE1Od/6Fmo8L8vC6bp +8jQ87PcDx4eo0kxAGTVGamlUsLihVo7spNU96LHc/RzY9HdaXFSMb++hUD38dglo +hJ9vytsgjTVgHAIDyyCwrFigDkBjxZgiwbJZ9VVrzyerbHbObyMt9H5xaiNrIv8S +uFQtJ37YOtnwtoeW/VvRXKwYw02fc7cBqZ9Xql4o4rmU +-----END CERTIFICATE----- + diff --git a/evidence/time/digicert-2026-11-03/verify.sh b/evidence/time/digicert-2026-11-03/verify.sh new file mode 100755 index 0000000..d4a0e5f --- /dev/null +++ b/evidence/time/digicert-2026-11-03/verify.sh @@ -0,0 +1,113 @@ +#!/usr/bin/env bash +# Verifies the RFC 3161 time-stamp tokens of this directory, offline, and that each stamp lies inside the validity of the CIC certificates that signed the records. +# +# verify.sh run from a clone of cic-primitives that holds the three release commits (git history); exit 0 only if every check holds +# verify.sh --selftest the same, and then the NEGATIVE controls, which must FAIL; if one of them passes, this script fails +# +# THE TIME. The time of a stamp is read from the TOKEN (the signed genTime), never from manifest.json; the manifest value is only compared with it. EVERY token check runs +# at that time (-attime), so a later end of the TSA chain does not change the result, and the check does not depend on the clock of the machine. +# +# Per release it checks: (1) the record, read from git at its release commit, has the SHA-256 the manifest names; (2) the token answers our request, covers the record file, +# and chains to the self-signed DigiCert root kept in trust-anchor/, all three AT genTime; (3) the CIC certificates kept in cic-chain/ are the ones the record carries +# (developer, Source CA, root), the Developer CA that the record does NOT carry really issues the developer certificate, and genTime lies inside the validity window of +# EACH of the four (not before, not after), checked twice: openssl verify -attime over both chains, and plain arithmetic on the dates. +# Needs openssl, git, python3 with PyYAML (to read the certificates out of the record). No network. +set -u +HERE=$(cd "$(dirname "$0")" && pwd) +M="$HERE/manifest.json" +ANCHOR="$HERE/trust-anchor/DigiCert_Trusted_Root_G4.pem" +C="$HERE/cic-chain" +fail=0 +say() { printf '%s\n' "$*"; } +bad() { say "FAIL $*"; fail=1; } +ok() { say "ok $*"; } +mj() { python3 -c 'import json,sys;o=json.load(open(sys.argv[1])) +for k in sys.argv[2].split("."): o=o[int(k)] if isinstance(o,list) else o[k] +print(o)' "$M" "$1"; } +fp() { openssl x509 -in "$1" -noout -fingerprint -sha256 | cut -d= -f2; } +epoch() { date -u -d "$1" +%s; } +notbefore() { epoch "$(openssl x509 -in "$1" -noout -startdate | cut -d= -f2)"; } +notafter() { epoch "$(openssl x509 -in "$1" -noout -enddate | cut -d= -f2)"; } + +# the four CIC certificates must lie around a time: plain arithmetic, fail closed. Prints nothing; returns 0 only if EVERY one holds at $1 (epoch). +cic_window_ok() { + local t=$1 f + for f in developer.pem developer-ca.pem source-ca.pem root.pem; do + [ "$(notbefore "$C/$f")" -le "$t" ] && [ "$t" -le "$(notafter "$C/$f")" ] || return 1 + done +} +# the same time, by openssl over the two chains the records use (developer <- Developer CA <- root, and Source CA <- root) +cic_chains_ok() { + local t=$1 + openssl verify -attime "$t" -CAfile "$C/root.pem" -untrusted "$C/developer-ca.pem" "$C/developer.pem" >/dev/null 2>&1 && + openssl verify -attime "$t" -CAfile "$C/root.pem" "$C/source-ca.pem" >/dev/null 2>&1 +} + +# ---- the anchors and the kept certificates are the ones the manifest names +want256=$(mj trust_anchor.sha256); want1=$(mj trust_anchor.sha1) +[ "$(fp "$ANCHOR")" = "$want256" ] && [ "$(openssl x509 -in "$ANCHOR" -noout -fingerprint -sha1 | cut -d= -f2)" = "$want1" ] && ok "TSA trust anchor $want256" || bad "TSA trust anchor differs from the manifest" +for name in developer developer-ca source-ca root; do + want=$(mj "cic_chain.$name.sha256"); got=$(fp "$C/$name.pem") + [ "$got" = "$want" ] && ok "CIC certificate $name $got" || bad "CIC certificate $name differs from the manifest ($got)" +done + +n=$(python3 -c 'import json,sys;print(len(json.load(open(sys.argv[1]))["stamps"]))' "$M") +tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT +for i in $(seq 0 $((n - 1))); do + rel=$(mj "stamps.$i.release"); commit=$(mj "stamps.$i.record.git_commit"); path=$(mj "stamps.$i.record.path"); rsha=$(mj "stamps.$i.record.sha256") + tsr="$HERE/$(mj "stamps.$i.response.file")"; tsq="$HERE/$(mj "stamps.$i.request.file")"; manifest_time=$(mj "stamps.$i.response.stamp_time_utc") + if ! git cat-file -e "$commit^{commit}" 2>/dev/null; then bad "$rel: the commit $commit is not in this clone (fetch the full history)"; continue; fi + git show "$commit:$path" > "$tmp/rec-$rel.yaml" 2>/dev/null + [ "$(sha256sum "$tmp/rec-$rel.yaml" | cut -d' ' -f1)" = "$rsha" ] && ok "$rel: the record at ${commit:0:8} has sha256 ${rsha:0:16}..." || { bad "$rel: the record at $commit is not the one in the manifest"; continue; } + + # the time, from the token + token_time=$(openssl ts -reply -in "$tsr" -text 2>/dev/null | sed -n 's/^Time stamp: //p') + if [ -z "$token_time" ]; then bad "$rel: no time stamp could be read from the token"; continue; fi + at=$(epoch "$token_time") + [ "$token_time" = "$manifest_time" ] && ok "$rel: the time in the token ($token_time) equals the manifest" || bad "$rel: the time in the token ($token_time) is not the manifest's ($manifest_time)" + + # the token, ALL checks at the stamp time + openssl ts -verify -queryfile "$tsq" -in "$tsr" -CAfile "$ANCHOR" -attime "$at" >/dev/null 2>&1 && ok "$rel: the token answers our request (digest and nonce) and chains to the anchor, at $token_time" || bad "$rel: the token does not answer the request / does not chain to the anchor at the stamp time" + openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" -attime "$at" >/dev/null 2>&1 && ok "$rel: the token covers the record file, at $token_time" || bad "$rel: the token does not cover the record file at the stamp time" + + # the CIC certificates: the kept ones are the record's own, the Developer CA is the issuer, and the stamp lies inside every window + # compared as CERTIFICATES (the SHA-256 of the DER), not as text: the field of a record may be a plain PEM (v0.1.5) or the printed text of openssl x509 -text with the PEM + # block at its end (v0.2.0, v0.2.1); a record is not changed for that, and the same certificate must be recognised in both + python3 - "$tmp/rec-$rel.yaml" "$tmp" "$rel" <<'PY' || true +import sys, yaml +rec = yaml.safe_load(open(sys.argv[1], encoding="utf-8")); out, rel = sys.argv[2], sys.argv[3] +fields = {"developer": rec["release"]["createdBy"]["certificate"], "source-ca": rec["cic_countersign"]["authority"]["certificate"], "root": rec["cic_countersign"]["authority"]["root_certificate"]} +for k, v in fields.items(): + i = v.find("-----BEGIN CERTIFICATE-----") + open("%s/%s-%s.pem" % (out, rel, k), "w", encoding="utf-8").write(v[i:] if i >= 0 else "") +PY + diffs="" + for k in developer source-ca root; do + r="$tmp/$rel-$k.pem" + if [ -s "$r" ] && [ "$(fp "$r" 2>/dev/null)" = "$(fp "$C/$k.pem")" ]; then :; else diffs="$diffs $k"; fi + done + [ -z "$diffs" ] && echo SAME > "$tmp/cmp-$rel.txt" || echo "DIFFERENT:$diffs" > "$tmp/cmp-$rel.txt" + [ "$(cat "$tmp/cmp-$rel.txt")" = "SAME" ] && ok "$rel: developer, Source CA and root kept here are the same certificates as the record carries (by DER, not by text)" || bad "$rel: the certificates kept here are not the record's own ($(cat "$tmp/cmp-$rel.txt"))" + cic_chains_ok "$at" && ok "$rel: openssl: both CIC chains are valid at the stamp time, the Developer CA being the issuer of the developer certificate" || bad "$rel: openssl: a CIC chain is NOT valid at the stamp time" + if cic_window_ok "$at"; then + ok "$rel: the stamp ($token_time) is inside the validity of the developer certificate, Developer CA, Source CA and root" + for f in developer developer-ca source-ca root; do say " margin before the end of $f.pem: $(( ($(notafter "$C/$f.pem") - at) / 86400 )) days"; done + else bad "$rel: the stamp is OUTSIDE the validity of at least one CIC certificate"; fi + + if [ "${1:-}" = "--selftest" ]; then + cp "$tmp/rec-$rel.yaml" "$tmp/alt-$rel.yaml"; printf '#' >> "$tmp/alt-$rel.yaml" + if openssl ts -verify -data "$tmp/alt-$rel.yaml" -in "$tsr" -CAfile "$ANCHOR" -attime "$at" >/dev/null 2>&1; then bad "$rel: SELFTEST a record changed by one byte was ACCEPTED"; else ok "$rel: selftest, a record changed by one byte is refused"; fi + if openssl ts -verify -data "$tmp/rec-$rel.yaml" -in "$tsr" -CAfile /usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt -attime "$at" >/dev/null 2>&1; then bad "$rel: SELFTEST a wrong anchor was ACCEPTED"; else ok "$rel: selftest, a wrong anchor is refused"; fi + after=$(epoch "2027-01-15"); before=$(epoch "2026-03-01") + if cic_window_ok "$after" || cic_chains_ok "$after"; then bad "$rel: SELFTEST a stamp in 2027, after the CIC chain ended, was ACCEPTED"; else ok "$rel: selftest, a stamp after the end of the CIC chain is refused (both ways)"; fi + if cic_window_ok "$before" || cic_chains_ok "$before"; then bad "$rel: SELFTEST a stamp before the CIC chain began was ACCEPTED"; else ok "$rel: selftest, a stamp before the CIC chain began is refused (both ways)"; fi + between=$(epoch "2026-12-31 13:22:50") # after the Developer CA (13:22:46) and the Source CA (13:22:39) ended, before the developer certificate (13:22:59) did + if cic_window_ok "$between" || cic_chains_ok "$between"; then bad "$rel: SELFTEST a stamp after ONE of the CIC certificates ended was ACCEPTED"; else ok "$rel: selftest, a stamp when only SOME CIC certificates are still valid is refused"; fi + fi +done +if [ "${1:-}" = "--selftest" ]; then + # the Developer CA that issues the developer certificate must be the real one: the Source CA in its place is refused + if openssl verify -attime "$(epoch '2026-11-03 22:07:48')" -CAfile "$C/root.pem" -untrusted "$C/source-ca.pem" "$C/developer.pem" >/dev/null 2>&1; then bad "SELFTEST the Source CA was accepted as the issuer of the developer certificate"; else ok "selftest, a wrong issuer of the developer certificate is refused"; fi +fi +[ "$fail" = 0 ] && say "ALL CHECKS HOLD" || say "AT LEAST ONE CHECK FAILED" +exit "$fail"