Skip to content

Set when timestamping is used

Decide whether your tenant's signatures carry an RFC 3161 timestamp, when the deployment leaves that choice to each tenant.

Who can do it

A tenant administrator or a tenant key manager changes the tenant's selection on the Policies screen. A platform super administrator sets it for any tenant from Platform Policies, and is the one who makes a tenant's first selection.

The TSA Usage card appears only while the deployment's TSA usage is OPTIONAL. In the other two deployment modes the deployment decides for every tenant and there is nothing to choose here. Without the write permission the card is read-only.

Before you start

  • To select ON, a time-stamping connection must be configured to stamp for your tenant: the tenant's own connection when it has one, the deployment's otherwise.
  • While your tenant inherits the deployment default, the switch on the tenant's card is disabled and says Inherited from the deployment default. Managed by your platform administrator. A platform super administrator makes the first selection.

Steps

  1. Open Policies and find the TSA Usage card.
  2. Select the mode:
    • ON stamps every signature of the tenant.
    • OFF stamps none.
    • inherit gives up the tenant's selection and follows the deployment default.

A platform super administrator opens Platform Policies, finds the tenant in Per-Tenant Policies, selects the badge in its TSA column, and chooses ON, OFF or inherit in the same way. The column is shown only while the deployment's TSA usage is OPTIONAL.

What you see when it worked

  • Selecting ON or OFF shows TSA usage policy updated, and the card names the mode in effect.
  • Selecting inherit shows TSA usage policy now follows the deployment default.

The selection applies to the next signature of the tenant. Signatures already made are not changed. Acceptance checks the connection's configuration, not its reachability: a selection that is accepted does not guarantee a timestamp will be issued.

If it fails

What you see Cause What to do
Timestamping cannot be required for this tenant at this time. Contact your platform administrator. No time-stamping connection is configured to stamp for the tenant: it is disabled, has no valid https endpoint, or has no active trust anchor A platform administrator configures the connection, then you retry
The switch is disabled with Inherited from the deployment default. The tenant has no selection of its own yet A platform super administrator makes the first selection from Platform Policies
The TSA Usage card is not shown The deployment's TSA usage is not OPTIONAL, or you lack the permission to read it Ask the platform administrator
You don't have permission to perform this action. You lack the write permission Ask for a role that holds it

Without the console

Surface How
Key management CLI No command
Admin SDK Not available
API PUT /api/v3/admin/tenants/{tenantId}/policies/tsa-usage with mode REQUIRED or DISABLED (operation replaceTenantTsaUsagePolicy); DELETE /api/v3/admin/tenants/{tenantId}/policies/tsa-usage to follow the deployment default (operation resetTenantTsaUsagePolicy)