{"v":1,"note":"Each RFC 3161 token must chain to one of its TSA's pinned time-stamping CAs: openssl ts -verify -partial_chain -digest <sha256 of receipt_jcs> -in <token>.tsr -CAfile <tsa>.pem (OpenSSL 1.1 or later). Build the CA file from the TSA's own repository (build_from_tsa) and compare each certificate's SHA-256 fingerprint. Accepted signers: subject organization and common name as listed.","tsas":[{"name":"sectigo","operator":"Sectigo","url":"http://timestamp.sectigo.com","in_use":true,"signer":{"organization":"Sectigo Limited","common_name_pattern":"^Sectigo Public Time Stamping Signer R\\d+$"},"pinned_ca":[{"subject":"C=GB, O=Sectigo Limited, CN=Sectigo Public Time Stamping Root R46","sha256":"B5:3A:C1:5C:C1:AF:B6:E2:AC:06:82:8F:55:5B:B3:BF:5B:AD:8B:2B:AC:17:33:CE:4C:B7:AA:FE:72:93:56:DE"}],"tsa_repository":["http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c"],"build_from_tsa":"curl -s http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c | openssl pkcs7 -inform DER -print_certs | awk '/^issuer=.*USERTrust RSA Certification Authority/{f=1} f; f && /END CERTIFICATE/{exit}' > sectigo.pem && openssl x509 -in sectigo.pem -noout -subject -fingerprint -sha256","ca_url":"https://anchor.isokron.ai/.well-known/tsa-ca/sectigo.pem"},{"name":"digicert","operator":"DigiCert","url":"http://timestamp.digicert.com","in_use":true,"signer":{"organization":"DigiCert, Inc.","common_name_pattern":"^(DigiCert Timestamp \\d{4}|DigiCert SHA(256|384) RSA4096 Timestamp Responder \\d{4} \\d+)$"},"pinned_ca":[{"subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA","sha256":"28:17:34:D4:59:2D:12:91:D2:71:90:70:9C:B5:10:B0:7E:22:C4:05:D5:E0:D6:11:9B:70:E7:35:89:F9:8A:CF"},{"subject":"C=US, O=DigiCert, Inc., CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1","sha256":"CA:0B:15:54:EC:D9:01:EA:19:DC:AD:87:49:E9:F2:64:8C:8D:6D:FC:EA:1A:DD:9D:2C:21:09:41:5B:B8:2C:CD"}],"tsa_repository":["https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt","https://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt"],"build_from_tsa":"rm -f digicert.pem; for c in DigiCertTrustedG4RSA4096SHA256TimeStampingCA DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1; do curl -s https://cacerts.digicert.com/$c.crt | openssl x509 -inform DER | tee -a digicert.pem | openssl x509 -noout -subject -fingerprint -sha256; done","ca_url":"https://anchor.isokron.ai/.well-known/tsa-ca/digicert.pem"}]}