> For the complete documentation index, see [llms.txt](https://docs.apryse.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apryse.com/core/digital-signature/emb-tst.md).

# Embedded Timestamp Tokens with custom signing API on Server/Desktop

Learn how to create and insert secure timestamp tokens with the custom signing API for PAdES-format signature conformance. Ensure verifiability by adding trusted root certificates. Enable online CRL r

{% hint style="info" %}
**Requirements**

*These packages are required to use these features in production. Trial keys have unlimited access to all features*

<a href="https://apryse.com/capabilities#DigitalSignature" class="button primary">Package: Digital Signature</a><a href="https://showcase.apryse.com/digital-signatures" class="button primary">Live demo</a>
{% endhint %}

The custom signing API also allows the creation and insertion of embedded secure (signed) timestamp tokens, which is a requirement of certain higher levels of PAdES-format signature conformance.

It is necessary to add to the VerificationOptions a trusted root certificate corresponding to the chain used by the timestamp authority to sign the timestamp token, in order for the timestamp response to be verifiable during embedded timestamp creation.

By default, we only check online for revocation of certificates using the newer and lighter OCSP protocol as opposed to CRL, due to lower resource usage and greater reliability. However, it may be necessary to enable online CRL revocation checking in order to verify some timestamps (i.e. those that do not have an OCSP responder URL for all non-trusted certificates).

{% tabs %}
{% tab title="C#" %}
{% code lineNumbers="true" %}

```csharp
TimestampingConfiguration tst_config = new TimestampingConfiguration(in_timestamp_authority_url);
VerificationOptions opts = new VerificationOptions(VerificationOptions.SignatureVerificationSecurityLevel.e_compatibility_and_archiving);
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path);
opts.EnableOnlineCRLRevocationChecking(true);
TimestampingResult result = digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts);

if (!result.GetStatus())
{
	Console.WriteLine(result.GetString());
	throw new Exception();
}
doc.SaveCustomSignature(result.GetData(), digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="C++" %}
{% code lineNumbers="true" %}

```cpp
TimestampingConfiguration tst_config(in_timestamp_authority_url);
VerificationOptions opts(VerificationOptions::e_compatibility_and_archiving);
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path);
opts.EnableOnlineCRLRevocationChecking(true);
TimestampingResult result(digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts));

BASE_ASSERT(result.GetStatus(), result.GetString().ConvertToUtf8().c_str());
std::vector<UChar> cms_with_timestamp(result.GetData());
doc.SaveCustomSignature(cms_with_timestamp.data(), cms_with_timestamp.size(),
	digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="Go" %}
{% code lineNumbers="true" %}

```go
tst_config := NewTimestampingConfiguration(in_timestamp_authority_url)
opts := NewVerificationOptions(VerificationOptionsE_compatibility_and_archiving)
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path)
opts.EnableOnlineCRLRevocationChecking(true)
result := digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts)

if result.GetStatus() {
	fmt.Println(result.GetString())
	return errors.New()
}
doc.SaveCustomSignature(result.GetData(), digsig_field, in_outpath)
```

{% endcode %}
{% endtab %}

{% tab title="Java" %}
{% code lineNumbers="true" %}

```java
TimestampingConfiguration tst_config = new TimestampingConfiguration(in_timestamp_authority_url);
VerificationOptions opts = new VerificationOptions(VerificationOptions.SecurityLevel.e_compatibility_and_archiving);
opts.addTrustedCertificate(in_timestamp_authority_root_certificate_path);
opts.enableOnlineCRLRevocationChecking(true);
TimestampingResult result = digsig_field.generateContentsWithEmbeddedTimestamp(tst_config, opts);

if (!result.getStatus())
{
	System.out.println(result.getString());
	throw new Exception();
}
doc.saveCustomSignature(result.getData(), digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="JavaScript" %}
{% code lineNumbers="true" %}

```js
const tst_config = await new PDFNet.TimestampingConfiguration(in_timestamp_authority_url);
const opts = await new PDFNet.VerificationOptions(PDFNet.VerificationOptions.SecurityLevel.e_compatibility_and_archiving);
await opts.addTrustedCertificate(in_timestamp_authority_root_certificate_path);
await opts.enableOnlineCRLRevocationChecking(true);
const result = await digsig_field.generateContentsWithEmbeddedTimestamp(tst_config, opts);

if (!(await result.getStatus()))
{
	console.log(await result.getString());
	throw new Error();
}
await doc.saveCustomSignature(await result.getData(), digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="Obj-C" %}
{% code lineNumbers="true" %}

```objc
PTTimestampingConfiguration* tst_config = [[TimestampingConfiguration alloc] init: in_timestamp_authority_url];
PTVerificationOptions* opts = [[VerificationOptions alloc] init: e_ptcompatibility_and_archiving];
[opts AddTrustedCertificate: in_timestamp_authority_root_certificate_path];
[opts EnableOnlineCRLRevocationChecking: true];
PTTimestampingResult* result = [digsig_field GenerateContentsWithEmbeddedTimestamp: tst_config in_timestamp_response_verification_options: opts];

if (![result GetStatus])
{
	NSLog([result GetString]);
	return NO;
}
[doc SaveCustomSignature: [result GetData] in_field: digsig_field in_path: in_outpath];
```

{% endcode %}
{% endtab %}

{% tab title="PHP" %}
{% code lineNumbers="true" %}

```php
$tst_config = new TimestampingConfiguration($in_timestamp_authority_url);
$opts = new VerificationOptions(VerificationOptions::e_compatibility_and_archiving);
$opts->AddTrustedCertificate($in_timestamp_authority_root_certificate_path);
$opts->EnableOnlineCRLRevocationChecking(True);
$result = $digsig_field->GenerateContentsWithEmbeddedTimestamp($tst_config, $opts);

if (!$result->GetStatus())
{
	echo(nl2br($result->GetString().PHP_EOL));
	assert(False);
}
$doc->SaveCustomSignature($result->GetData(), $digsig_field, $in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="Python" %}
{% code lineNumbers="true" %}

```python
tst_config = TimestampingConfiguration(in_timestamp_authority_url)
opts = VerificationOptions(VerificationOptions.e_compatibility_and_archiving)
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path)
opts.EnableOnlineCRLRevocationChecking(True)
result = digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts)

if not result.GetStatus():
	print(result.GetString())
	assert(False)
doc.SaveCustomSignature(result.GetData(), digsig_field, in_outpath)
```

{% endcode %}
{% endtab %}

{% tab title="Ruby" %}
{% code lineNumbers="true" %}

```ruby
tst_config = TimestampingConfiguration(in_timestamp_authority_url);
opts = VerificationOptions.new(VerificationOptions.e_compatibility_and_archiving);
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path);
opts.EnableOnlineCRLRevocationChecking(true);
result = digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts);

if !result.GetStatus() then
	puts(result.GetString());
	raise "Error";
doc.SaveCustomSignature(result.GetData(), digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.apryse.com/core/digital-signature/emb-tst.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.