Open TSA provides free, open-source RFC 3161 timestamp infrastructure for Europe — so that any developer, researcher, NGO, or startup can build on a solid trust foundation without cost or lock-in.
A trusted timestamp is not an end product — it is infrastructure. Every system building document signing, code signing, audit trails, or identity verification needs a TSA as a foundational component.
Today, that component is either expensive (commercial TSAs cost €200–1,000+/year) or unreliable (the dominant free service is operated by a single private individual with no open-source code and no redundancy).
"Digital freedom requires open infrastructure. Cryptographic trust should not be a privilege of those who can afford it."
Open TSA fills this gap. We lower the barrier to entry for an entire class of European security projects to zero.
Root keys are kept offline. All source code is published under MIT license. View Source →
Your document never leaves your system. Only a cryptographic hash is sent to our server — we never see your content.
A SHA-256 (or SHA-384/512) hash of your document is computed locally. The document itself is never transmitted.
The hash is sent as an RFC 3161 TimeStampRequest to tsr.open-tsa.eu. Our server signs it with the current time and returns a TimeStampResponse.
The response proves that your document existed in its exact form at that specific moment in time. Verification works offline, forever.
# Step 1: Download CA certificates (once) curl -s https://open-tsa.eu/certs/ca.crt -o ca.crt curl -s https://open-tsa.eu/certs/fullchain.pem -o fullchain.pem # Step 2: Timestamp your document openssl ts -query -data document.pdf -cert -sha256 -no_nonce -out req.tsq curl -s -S -H "Content-Type: application/timestamp-query" \ --data-binary @req.tsq https://tsr.open-tsa.eu -o resp.tsr # Step 3: Verify openssl ts -verify -in resp.tsr -queryfile req.tsq \ -CAfile ca.crt -untrusted fullchain.pem
const fs = require('fs');
const { execFile } = require('child_process');
const { promisify } = require('util');
const execAsync = promisify(execFile);
async function timestamp(filePath) {
const tsq = `/tmp/ts-${Date.now()}.tsq`;
await execAsync('openssl', [
'ts', '-query', '-data', filePath,
'-cert', '-sha256', '-no_nonce', '-out', tsq
]);
const response = await fetch('https://tsr.open-tsa.eu', {
method: 'POST',
headers: { 'Content-Type': 'application/timestamp-query' },
body: fs.readFileSync(tsq),
});
if (!response.ok) {
throw new Error(`TSA ${response.status}`);
}
return Buffer.from(await response.arrayBuffer());
}
import os
import requests
import subprocess
import tempfile
def timestamp(file_path: str) -> bytes:
with tempfile.NamedTemporaryFile(suffix=".tsq", delete=False) as f:
tsq = f.name
try:
subprocess.run([
"openssl", "ts", "-query", "-data", file_path,
"-cert", "-sha256", "-no_nonce", "-out", tsq
], check=True, capture_output=True)
with open(tsq, "rb") as f:
data = f.read()
r = requests.post(
"https://tsr.open-tsa.eu",
data=data,
headers={"Content-Type": "application/timestamp-query"},
timeout=15
)
r.raise_for_status()
return r.content
finally:
os.unlink(tsq)
# Drop-in replacement for any RFC 3161 TSA TSA_URL=https://tsr.open-tsa.eu TSA_CA_URL=https://open-tsa.eu/certs/ca.crt TSA_FULLCHAIN_URL=https://open-tsa.eu/certs/fullchain.pem # API info OPEN_TSA_INFO_URL=https://open-tsa.eu/info
Full documentation → open-tsa.eu/docs/
GET https://open-tsa.eu/now — returns JSON with ISO-8601, Unix epoch, and RFC 2822 format. Built for AI agents and distributed systems. No auth, CORS-enabled. For cryptographic proof, use POST https://tsr.open-tsa.eu (RFC 3161).
Download the CA certificates once to verify timestamps offline. Supplied explicitly — our root CA is not yet in public trust stores.
RFC 3161 compliant endpoint live in Germany. 4-tier CA hierarchy. Open-source code on European infrastructure.
● LiveRedundant nodes in Helsinki + Falkenstein. GeoDNS failover. Sub-CA under HARICA for automatic trust in all major browsers.
PlannedExpand open-ca.eu to cover document signing and TLS. Apply for Mozilla root program inclusion.
RoadmapAm 24. April 2026 ging Open TSA öffentlich live — ein kostenloser, quelloffener RFC-3161-Zeitstempeldienst aus Deutschland. Heute, drei Wochen später, ist…
Read more →Open TSA ist ein kostenloser, quelloffener RFC-3161-Zeitstempel-Dienst, betrieben aus einem deutschen Hochverfügbarkeits-Rechenzentrum. Nach drei Wochen öffentlicher Verfügbarkeit hat der Dienst…
Read more →Open TSA is free for everyone, forever. No ads, no tracking, no investor pressure. Running this infrastructure costs money — every contribution keeps it alive and independent.