Client

RFC 3161 timestamp codec. Builds a TimeStampReq for a signature, parses a TimeStampResp to extract the timestamp token, and maps digest algorithms to their OIDs. HTTP transport is injected into requestToken(), so the codec performs no network access and the host controls networking and SSRF protection.

Table of contents

Namespace: Com\Tecnick\Pdf\Sign\Timestamp

Final: Yes

File: Client.php line 56

RFC 3161 timestamp codec. Builds a TimeStampReq for a signature, parses a TimeStampResp to extract the timestamp token, and maps digest algorithms to their OIDs. HTTP transport is injected into requestToken(), so the codec performs no network access and the host controls networking and SSRF protection.

A returned token is verified before it is embedded: its SignerInfo signature must check out against the TSA certificate the token carries, and its TSTInfo must answer the request that was sent, per RFC 3161 section 2.4.2. That means the same message imprint, the same policy when one was requested, the nonce echoed unchanged, and a genTime near the moment of the request.

The certificate that signed it must be a TSA certificate reserved for timestamping (RFC 3161 section 2.3), and must have been inside its validity period at the instant the token attests.

Tags

Constants

CLOCK_SKEW

File: Client.php line 67

public mixed CLOCK_SKEW = \Com\Tecnick\Pdf\Sign\Ocsp\Client::CLOCK_SKEW

Methods

__construct()

File: Client.php line 81

public __construct(Config $config[, Asn1|null $asn1 = null ][, Certificate|null $certificate = null ][, SignedDataVerifier|null $verifier = null ][, int $clockSkew = self::CLOCK_SKEW ]) : mixed

Parameters

  • $config : Config
  • $asn1 : Asn1|null = null
  • $certificate : Certificate|null = null
  • $verifier : SignedDataVerifier|null = null
  • $clockSkew : int = self::CLOCK_SKEW: Skew tolerated between the token’s genTime and the moment of the request, in seconds.

Tags

buildRequest()

File: Client.php line 113

public buildRequest(string $signature) : Request

Parameters

  • $signature : string: Signature (or any bytes) to be timestamped.

Tags

  • throws: Exception If encoding fails or a nonce cannot be generated.

Return values

Request —

The DER request and the imprint and nonce a token must match.

hashAlgorithmOid()

File: Client.php line 622

public hashAlgorithmOid(string $algorithm) : string

Parameters

  • $algorithm : string

Tags

  • throws: Exception If the algorithm is not supported.

Return values

string

parseResponse()

File: Client.php line 164

public parseResponse(string $response, Request $request[, int|null $now = null ]) : string

The status is checked first, then the token’s TSTInfo is matched against the request: the messageImprint must be the digest that was sent under the same algorithm, and the nonce must come back unchanged.

Parameters

  • $response : string: DER-encoded timestamp response.
  • $request : Request: The request this response answers.
  • $now : int|null = null: Unix time the token’s genTime is checked against; defaults to the current time.

Tags

  • throws: Exception If the response is empty, malformed, rejected, or does not match the request.

Return values

string —

DER-encoded timestamp token (ContentInfo).

requestToken()

File: Client.php line 231

public requestToken(string $signature, callable $transport[, int|null $now = null ]) : string

Parameters

  • $signature : string: Signature bytes to timestamp.
  • $transport : callable: Receives the DER request string and must return the DER response string.
  • $now : int|null = null: Unix time the token’s genTime is checked against; defaults to the current time.

Tags

  • throws: Exception If encoding, transport, or validation fails.

Return values

string

tokenCertificates()

File: Client.php line 255

public tokenCertificates(string $tokenDer) : array<int, string>

The TSA certificate chain is validation material a PAdES B-LT document needs in its Document Security Store, alongside the signer’s own chain. An entry that is not a certificate is dropped by Cms\Certificate::fromSignedData().

Parameters

  • $tokenDer : string

Tags

  • throws: Exception If the token cannot be parsed.

Return values

array<int, string> —

DER certificates, empty when the token embeds none.