Question

[root@LINUX misc]# pwd
/usr/local/openssl/ssl/misc
[root@LINUX misc]# ./tsget -h http://tsa.opentsa.org:8080/tsa ../../bin/alllog.log.tsq
../../bin/alllog.log.tsq: fatal error: could not get timestamp, curl code: 7 (couldn't connect to host)

How can I confugure the time stamp Authority server to get signed tsq file?
The example above shows how to send a tsq to the server URL(http://tsa.opentsa.org:8080/tsa) but I could not understand how to start server to handle thie request.

Answer 1

You may want to try simply opening http://tsa.opentsa.org:8080/tsa in your browser – at the time of writing the error code ‘couldb’t connect to host’ seems spot on. I can at least not connect to the server tsa.opentsa.org on port 8080 at this time. And alternatives like http://tsa.opentsa.org/ suggest a plain drupal reinstall.

Now the second part – how does one use this.

Which typically is by creating a tsq file first. See http://manpages.ubuntu.com/manpages/precise/man1/tsget.1ssl.html for a nice example of which the crux is

  openssl ts -query -data file-to-get-timestamped.txt -cert <your cert> > file.tsq

and the result of this is then send with tsget.

If you want to start one at tsa.opentsa.org – then you need to work with them (the owners of opentsa.org).

If you mean starting one like the one at opentsa.org (which is currently) done; then in that case one would download & install software such as athttp://opentsa.org/#download (which involves installing openssl, applying the patch at tsa.org and then installing the mod_tsa module) or installing a commercial product, such as http://www.ascertia.com/products/ADSS-TSA-Server.aspx.

If you just want to test/experiment a bit – have a look at http://owcapage.wordpress.com/linux-time-stamp-server/ – which is much simpler to use or in the most extreme case run the ts command like

openssl ts -reply -queryfile design1.tsq -inkey tsakey.pem \
    -signer tsacert.pem -out design1.tsr

behind the ‘webserver’. And where design1.tsq is the file you got as the payload over the wire from the HTTP client – and design1.tsr is what you would output as a result.

So your cgi/perl/php/etc script would be along the lines of

 1. create temp file containing GET/POST payload
 2. run above openssl ts command over it
 3. output the resulting file back

which is in effect exactly what the simple scripts at http://owcapage.wordpress.com/linux-time-stamp-server/ do.