> For the complete documentation index, see [llms.txt](https://docs.apryse.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apryse.com/core/digital-signature/emb-tst.md).

# Embedded Timestamp Tokens with custom signing API on Server/Desktop

Learn how to create and insert secure timestamp tokens with the custom signing API for PAdES-format signature conformance. Ensure verifiability by adding trusted root certificates. Enable online CRL r

{% hint style="info" %}
**Requirements**

*These packages are required to use these features in production. Trial keys have unlimited access to all features*

<a href="https://apryse.com/capabilities#DigitalSignature" class="button primary">Package: Digital Signature</a><a href="https://showcase.apryse.com/digital-signatures" class="button primary">Live demo</a>
{% endhint %}

The custom signing API also allows the creation and insertion of embedded secure (signed) timestamp tokens, which is a requirement of certain higher levels of PAdES-format signature conformance.

It is necessary to add to the VerificationOptions a trusted root certificate corresponding to the chain used by the timestamp authority to sign the timestamp token, in order for the timestamp response to be verifiable during embedded timestamp creation.

By default, we only check online for revocation of certificates using the newer and lighter OCSP protocol as opposed to CRL, due to lower resource usage and greater reliability. However, it may be necessary to enable online CRL revocation checking in order to verify some timestamps (i.e. those that do not have an OCSP responder URL for all non-trusted certificates).

{% tabs %}
{% tab title="C#" %}
{% code lineNumbers="true" %}

```csharp
TimestampingConfiguration tst_config = new TimestampingConfiguration(in_timestamp_authority_url);
VerificationOptions opts = new VerificationOptions(VerificationOptions.SignatureVerificationSecurityLevel.e_compatibility_and_archiving);
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path);
opts.EnableOnlineCRLRevocationChecking(true);
TimestampingResult result = digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts);

if (!result.GetStatus())
{
	Console.WriteLine(result.GetString());
	throw new Exception();
}
doc.SaveCustomSignature(result.GetData(), digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="C++" %}
{% code lineNumbers="true" %}

```cpp
TimestampingConfiguration tst_config(in_timestamp_authority_url);
VerificationOptions opts(VerificationOptions::e_compatibility_and_archiving);
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path);
opts.EnableOnlineCRLRevocationChecking(true);
TimestampingResult result(digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts));

BASE_ASSERT(result.GetStatus(), result.GetString().ConvertToUtf8().c_str());
std::vector<UChar> cms_with_timestamp(result.GetData());
doc.SaveCustomSignature(cms_with_timestamp.data(), cms_with_timestamp.size(),
	digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="Go" %}
{% code lineNumbers="true" %}

```go
tst_config := NewTimestampingConfiguration(in_timestamp_authority_url)
opts := NewVerificationOptions(VerificationOptionsE_compatibility_and_archiving)
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path)
opts.EnableOnlineCRLRevocationChecking(true)
result := digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts)

if result.GetStatus() {
	fmt.Println(result.GetString())
	return errors.New()
}
doc.SaveCustomSignature(result.GetData(), digsig_field, in_outpath)
```

{% endcode %}
{% endtab %}

{% tab title="Java" %}
{% code lineNumbers="true" %}

```java
TimestampingConfiguration tst_config = new TimestampingConfiguration(in_timestamp_authority_url);
VerificationOptions opts = new VerificationOptions(VerificationOptions.SecurityLevel.e_compatibility_and_archiving);
opts.addTrustedCertificate(in_timestamp_authority_root_certificate_path);
opts.enableOnlineCRLRevocationChecking(true);
TimestampingResult result = digsig_field.generateContentsWithEmbeddedTimestamp(tst_config, opts);

if (!result.getStatus())
{
	System.out.println(result.getString());
	throw new Exception();
}
doc.saveCustomSignature(result.getData(), digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="JavaScript" %}
{% code lineNumbers="true" %}

```js
const tst_config = await new PDFNet.TimestampingConfiguration(in_timestamp_authority_url);
const opts = await new PDFNet.VerificationOptions(PDFNet.VerificationOptions.SecurityLevel.e_compatibility_and_archiving);
await opts.addTrustedCertificate(in_timestamp_authority_root_certificate_path);
await opts.enableOnlineCRLRevocationChecking(true);
const result = await digsig_field.generateContentsWithEmbeddedTimestamp(tst_config, opts);

if (!(await result.getStatus()))
{
	console.log(await result.getString());
	throw new Error();
}
await doc.saveCustomSignature(await result.getData(), digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="Obj-C" %}
{% code lineNumbers="true" %}

```objc
PTTimestampingConfiguration* tst_config = [[TimestampingConfiguration alloc] init: in_timestamp_authority_url];
PTVerificationOptions* opts = [[VerificationOptions alloc] init: e_ptcompatibility_and_archiving];
[opts AddTrustedCertificate: in_timestamp_authority_root_certificate_path];
[opts EnableOnlineCRLRevocationChecking: true];
PTTimestampingResult* result = [digsig_field GenerateContentsWithEmbeddedTimestamp: tst_config in_timestamp_response_verification_options: opts];

if (![result GetStatus])
{
	NSLog([result GetString]);
	return NO;
}
[doc SaveCustomSignature: [result GetData] in_field: digsig_field in_path: in_outpath];
```

{% endcode %}
{% endtab %}

{% tab title="PHP" %}
{% code lineNumbers="true" %}

```php
$tst_config = new TimestampingConfiguration($in_timestamp_authority_url);
$opts = new VerificationOptions(VerificationOptions::e_compatibility_and_archiving);
$opts->AddTrustedCertificate($in_timestamp_authority_root_certificate_path);
$opts->EnableOnlineCRLRevocationChecking(True);
$result = $digsig_field->GenerateContentsWithEmbeddedTimestamp($tst_config, $opts);

if (!$result->GetStatus())
{
	echo(nl2br($result->GetString().PHP_EOL));
	assert(False);
}
$doc->SaveCustomSignature($result->GetData(), $digsig_field, $in_outpath);
```

{% endcode %}
{% endtab %}

{% tab title="Python" %}
{% code lineNumbers="true" %}

```python
tst_config = TimestampingConfiguration(in_timestamp_authority_url)
opts = VerificationOptions(VerificationOptions.e_compatibility_and_archiving)
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path)
opts.EnableOnlineCRLRevocationChecking(True)
result = digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts)

if not result.GetStatus():
	print(result.GetString())
	assert(False)
doc.SaveCustomSignature(result.GetData(), digsig_field, in_outpath)
```

{% endcode %}
{% endtab %}

{% tab title="Ruby" %}
{% code lineNumbers="true" %}

```ruby
tst_config = TimestampingConfiguration(in_timestamp_authority_url);
opts = VerificationOptions.new(VerificationOptions.e_compatibility_and_archiving);
opts.AddTrustedCertificate(in_timestamp_authority_root_certificate_path);
opts.EnableOnlineCRLRevocationChecking(true);
result = digsig_field.GenerateContentsWithEmbeddedTimestamp(tst_config, opts);

if !result.GetStatus() then
	puts(result.GetString());
	raise "Error";
doc.SaveCustomSignature(result.GetData(), digsig_field, in_outpath);
```

{% endcode %}
{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.apryse.com/core/digital-signature/emb-tst.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.