TSGET(1ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 TSGET — the Time Stamping HTTP/HTTPS client, but make it a group chat 💖

okay so bestie, this is tsget, from the OpenSSL manual pages (it lives in section 1ossl). she's the little errand girl who takes your timestamp request, sprints over to a timestamp server via HTTP or HTTPS, and drops the response in a file. no cap. let's get into it 🦋

✨ SYNOPSIS ✨

tsget -h server_url [-e extension] [-o output] [-v] [-d] [-k
private_key.pem] [-p key_password] [-c client_cert.pem] [-C
CA_certs.pem] [-P CA_path] [-r files] [-g EGD_socket] [request ...]

🌸 DESCRIPTION 🌸

So here's the tea ☕: this command sends a timestamp request — exactly as specified in RFC 3161 — to a timestamp server over HTTP or HTTPS, and then stores the timestamp response in a file. That's her whole job. Periodt.

She can NOT create requests and she can NOT verify responses. You need openssl-ts(1) for that. tsget is strictly the delivery girl, not the baker. 💅

The cute part? If you hand her more than one request on the command line, she'll send several requests to the server without closing the TCP connection. Efficiency queen. 👑

For each timestamp request, she sends this HTTP request:

POST url HTTP/1.1
User-Agent: OpenTSA tsget.pl/<version>
Host: <host>:<port>
Pragma: no-cache
Content-Type: application/timestamp-query
Accept: application/timestamp-reply
Content-Length: length of body

...binary request specified by the user...

And she expects back a response of type application/timestamp-reply, which gets written straight to a file with zero interpretation. No reading it, no judging it, no translating it. Just vibes and bytes. 🫶

🎀 OPTIONS 🎀

  • -h server_url — the URL of the HTTP/HTTPS server that's out here listening for timestamp requests. this one's the main character, you literally cannot skip her.
  • -e extension — if you didn't give -o, this sets the extension of the output files. the base name of the output file will match the base name of the input files. default extension is .tsr. (Optional)
  • -o output — only allowed when you're sending just one request to the server. the timestamp response goes into this output file. - means standard output. if you've got multiple timestamp requests, or you just didn't pass this argument at all, the output file names get derived from the input file names plus the default-or-specified extension argument. (Optional)
  • -v — prints the name of the currently processed request on standard error. she's narrating her own life, honestly relatable. (Optional)
  • -d — switches on verbose mode for the underlying perl module WWW::Curl::Easy. you get detailed debug messages about the connection. it's giving behind-the-scenes documentary. (Optional)
  • -k private_key.pem — (HTTPS) for certificate-based client authentication over HTTPS, private_key.pem must contain the user's private key. the private key file can optionally be protected by a passphrase. the -c option must also be specified. (Optional)
  • -p key_password — (HTTPS) specifies the passphrase for the private key given by the -k argument. if you skip this option and the key is passphrase protected, she'll prompt you for it. (Optional)
  • -c client_cert.pem — (HTTPS) for certificate-based client authentication over HTTPS, client_cert.pem must contain the user's X.509 certificate. the -k option must also be specified. if you don't specify this option, no certificate-based client authentication happens at all. (Optional)
  • -C CA_certs.pem — (HTTPS) the trusted CA certificate store. the certificate chain of the peer's certificate must include one of the CA certificates specified in this file. for HTTPS, you must give either option -C or option -P. (Optional)
  • -P CA_path — (HTTPS) the path containing the trusted CA certificates used to verify the peer's certificate. the directory must be prepared with openssl-rehash(1). for HTTPS, you must give either option -C or option -P. (Optional)
  • -r files — see "Random State Options" in openssl(1) for more info, bestie.
  • -g EGD_socket — the name of an EGD socket to get random data from. (Optional)
  • request ... — a list of files containing RFC 3161 DER-encoded timestamp requests. if you don't specify any requests, only one request gets sent to the server and it's read from standard input. (Optional)

🌈 ENVIRONMENT VARIABLES 🌈

The TSGET environment variable can optionally hold default arguments. whatever's inside this variable gets added to the list of command line arguments. it's like pre-writing your order so you don't have to say it out loud every time. iconic behaviour, fr fr. 💜

🔥 EXAMPLES 🔥

okay so for all of these, we're presuming that file1.tsq and file2.tsq contain valid timestamp requests, that tsa.opentsa.org listens at port 8080 for HTTP requests and at port 8443 for HTTPS requests, and that the TSA service is available at the /tsa absolute path. setting the scene, building the world. 🌸

Get a timestamp response for file1.tsq over HTTP, output is written to file1.tsr:

tsget -h http://tsa.opentsa.org:8080/tsa file1.tsq

Get a timestamp response for file1.tsq and file2.tsq over HTTP showing progress, output is written to file1.reply and file2.reply respectively:

tsget -h http://tsa.opentsa.org:8080/tsa -v -e .reply \
      file1.tsq file2.tsq

Create a timestamp request, write it to file3.tsq, send it to the server and write the response to file3.tsr:

openssl ts -query -data file3.txt -cert | tee file3.tsq \
      | tsget -h http://tsa.opentsa.org:8080/tsa \
      -o file3.tsr

Get a timestamp response for file1.tsq over HTTPS without client authentication:

tsget -h https://tsa.opentsa.org:8443/tsa \
      -C cacerts.pem file1.tsq

Get a timestamp response for file1.tsq over HTTPS with certificate-based client authentication (it will ask for the passphrase if client_key.pem is protected):

tsget -h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
      -k client_key.pem -c client_cert.pem file1.tsq

You can shorten the previous command line if you make use of the TSGET environment variable. The following commands do the same as the previous example:

TSGET='-h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
      -k client_key.pem -c client_cert.pem'
export TSGET
tsget file1.tsq

👀 SEE ALSO 👀

openssl(1), openssl-ts(1), WWW::Curl::Easy, <https://www.rfc-editor.org/rfc/rfc3161.html>

Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🎀 this one's from OpenSSL 3.5.9, dated 2026-09-29, and it's TSGET(1ossl) — go timestamp something and slay ✨🦋

📦 where this page comes from