OpenTimeStamp

OpenTimeStamp is an IIS-hosted timestamp authority for Windows Server. It implements RFC 3161 timestamp replies and the legacy Microsoft Authenticode countersignature protocol using .NET Framework and Windows cryptography. Public timestamp endpoints can use Anonymous or Windows authentication, while the administrative interface remains restricted to the server.

This software creates cryptographic evidence, not an organizational trust framework. A production TSA also needs a controlled certificate lifecycle, trustworthy time, protected audit records, documented policies, monitoring, backup, and incident response.

Endpoints

For the default IIS application path /OpenTimeStamp:

Path	Method	Purpose
/OpenTimeStamp/timestamp/rfc3161	POST	RFC 3161 timestamping; use this for SignTool /tr
/OpenTimeStamp/timestamp/authenticode	POST	Legacy Authenticode timestamping; use this for SignTool /t
/OpenTimeStamp/health	GET	Operational health and readiness
/OpenTimeStamp/admin	GET, POST	Local, Windows-authenticated administration

See Protocols and Endpoints for supported algorithms, content types, and compatibility details.

Requirements

• Windows Server 2019 for RSA deployments, or Windows Server 2025 for RSA and supported ML-DSA deployments
• .NET Framework 4.8 or a compatible in-place update on the IIS server
• IIS 10
• Visual Studio 18 or later Build Tools with the .NET Framework 4.8 targeting pack and Web development build tools
• Windows PowerShell 5.1

The solution targets .NET Framework 4.8 (net48). The build uses a C# 14-capable compiler while emitting code compatible with that runtime. See Build Requirements and Publishing for complete prerequisites and release-payload guidance.

Quick Start

From a Windows PowerShell 5.1 prompt on the build computer:

.\tools\build\Build.ps1 -Configuration Release
.\tools\build\Publish.ps1 -Configuration Release

The deployable output is written to tools\artifacts\OpenTimeStamp, and the MSI is written to tools\artifacts\OpenTimeStamp-1.0.0-x64.msi. Install the payload manually from an elevated Windows PowerShell 5.1 prompt:

.\tools\deploy\Install-IisApplication.ps1 `
    -SourcePath .\tools\artifacts\OpenTimeStamp `
    -SiteName 'Default Web Site' `
    -ApplicationPath '/OpenTimeStamp' `
    -AuthenticationMode Anonymous `
    -AllowUnsignedManifest

-AllowUnsignedManifest is for development or explicitly approved legacy packages. Production deployment should use a detached, organization-signed manifest and HTTPS. Continue with the IIS Deployment guide before exposing the service.

Documentation

Topic	Guide
Protocol behavior and endpoint compatibility	Protocols and Endpoints
Build prerequisites and release publishing	Build Requirements and Publishing
MSI installation and signing	MSI Installer
IIS installation, certificates, upgrades, and validation	IIS Deployment
AD CS timestamp signing template and enrollment	Timestamp Signing Certificate Template
Separate signing profiles and request/signature hashes	Signing Endpoints and Hash Policies
Admin access, FIPS behavior, state, logs, and operations	Administration and Operations
Microsoft Office, VBA, and Adobe Acrobat clients	Client Configuration
Product-signing interoperability tests	Testing
Production hardening and incident guidance	Security Guidance

Repository Layout

Path	Contents
src	Web application, core timestamping implementation, and tests under src/tests
tools	Build and publishing scripts in build, deployment scripts in deploy, MSI tooling in msi, and generated output in artifacts
docs	Focused operator and integration documentation

Before a production rollout, review both the deployment guide and security guidance.