TSGET(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 tsget — the Time Stamping HTTP/HTTPS client 💖

okay so bestie, this is tsget, it lives in the OpenSSL manual pages (section 1SSL, slay), and it's literally just a little HTTP girlie whose whole job is delivering your timestamp requests to a server. that's it. that's the gig. periodt.

✨ SYNOPSIS ✨

tsget -h server_url [-e extension] [-o output] [-v] [-d] [-k
private_key.pem] [-p key_password] [-c client_cert.pem] [-C
CA_certs.pem] [-P CA_path] [-r files] [-g EGD_socket] [request ...]

🌸 DESCRIPTION 🌸

so what does this do? it sends a timestamp request — the kind specified in RFC 3161 — to a timestamp server over HTTP or HTTPS, and then it saves the timestamp response into a file. that's the whole vibe.

but listen, and this is important: it can NOT create the requests and it can NOT verify the responses. that's not her job, okay? if you need that, go use openssl-ts(1). she is just the delivery girl. 🛵💨

the iconic part? if you put more than one request on the command line, she'll send all of them to the server without closing the TCP connection. no cap, one connection, many requests, efficiency queen behavior 👑

for every single timestamp request she sends, this is the HTTP request that goes out:

POST url HTTP/1.1
User-Agent: OpenTSA tsget.pl/<version>
Host: <host>:<port>
Pragma: no-cache
Content-Type: application/timestamp-query
Accept: application/timestamp-reply
Content-Length: length of body

...binary request specified by the user...

and then she expects a response of type application/timestamp-reply back, which she writes straight to a file without any interpretation. no reading into it, no commentary, no notes. just vibes and bytes. 🫶

🎀 OPTIONS 🎀

  • -h server_url — the URL of the HTTP/HTTPS server that's out here listening for timestamp requests. this one's the moment, the whole point.
  • -e extension — if you didn't give her -o, this tells her what extension the output files should have. the base name of each output file will match the base name of its input file. default extension is .tsr. (optional!)
  • -o output — only allowed when you're sending exactly one request to the server. the timestamp response gets written into the file you name here. and '-' means standard output, she'll just yap it to your terminal. if you send multiple requests, or you just don't give her this argument, the output file names get derived from the input file names plus the default-or-specified extension argument. (optional!)
  • -v — prints the name of the currently processed request to standard error, so you can peek at the progress. (optional!)
  • -d — turns on verbose mode for the underlying perl module WWW::Curl::Easy. you get the detailed debug messages for the connection, like, the whole behind-the-scenes reality show. (optional!)
  • -k private_key.pem — (HTTPS) if you're doing certificate-based client authentication over HTTPS, private_key.pem must contain the user's private key. it can optionally be protected by a passphrase. and heads up, the -c option must also be specified with it. (optional!)
  • -p key_password — (HTTPS) this is the passphrase for the private key you gave in -k. if you skip this option and the key is passphrase protected, she'll prompt you for it. so no pressure. (optional!)
  • -c client_cert.pem — (HTTPS) for certificate-based client authentication over HTTPS, client_cert.pem must contain the user's X.509 certificate. the -k option must also be specified alongside it. and if you don't include this option at all? then no certificate-based client authentication happens, simple as that. (optional!)
  • -C CA_certs.pem — (HTTPS) the trusted CA certificate store. the certificate chain of the peer's certificate has to include one of the CA certificates listed in this file. and for HTTPS, either -C or -P must be given. one of them, bestie, pick one. (optional!)
  • -P CA_path — (HTTPS) the path holding the trusted CA certificates used to verify the peer's certificate. that directory must be prepared with openssl-rehash(1). again: either -C or -P must be given in case of HTTPS. (optional!)
  • -r files — go read "Random State Options" in openssl(1) for the full tea on this one.
  • -g EGD_socket — the name of an EGD socket to pull random data from. (optional!)
  • request ... — a list of files containing RFC 3161 DER-encoded timestamp requests. if you specify none, only one request gets sent to the server and it's read from standard input. (optional!)

🦋 ENVIRONMENT VARIABLES 🦋

the TSGET environment variable can optionally hold default arguments, and its content gets added to the list of command line arguments. so you can set it once and forget it, iconic lazy-girl efficiency 💅

🌈 EXAMPLES 🌈

okay so all these examples are assuming the following: file1.tsq and file2.tsq contain valid timestamp requests, tsa.opentsa.org is listening at port 8080 for HTTP requests and port 8443 for HTTPS requests, and the TSA service is available at the /tsa absolute path.

get a timestamp response for file1.tsq over HTTP, output written to file1.tsr:

tsget -h http://tsa.opentsa.org:8080/tsa file1.tsq

get a timestamp response for file1.tsq and file2.tsq over HTTP, showing progress, output written to file1.reply and file2.reply respectively:

tsget -h http://tsa.opentsa.org:8080/tsa -v -e .reply \
      file1.tsq file2.tsq

create a timestamp request, write it to file3.tsq, send it to the server, and write the response to file3.tsr:

openssl ts -query -data file3.txt -cert | tee file3.tsq \
      | tsget -h http://tsa.opentsa.org:8080/tsa \
      -o file3.tsr

get a timestamp response for file1.tsq over HTTPS, no client authentication:

tsget -h https://tsa.opentsa.org:8443/tsa \
      -C cacerts.pem file1.tsq

get a timestamp response for file1.tsq over HTTPS with certificate-based client authentication (she'll ask for the passphrase if client_key.pem is protected):

tsget -h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
      -k client_key.pem -c client_cert.pem file1.tsq

you can shorten that whole thing with the TSGET environment variable. these commands do the exact same as the previous example:

TSGET='-h https://tsa.opentsa.org:8443/tsa -C cacerts.pem \
      -k client_key.pem -c client_cert.pem'
export TSGET
tsget file1.tsq

👀 SEE ALSO 👀

openssl(1), openssl-ts(1), WWW::Curl::Easy, and <https://www.rfc-editor.org/rfc/rfc3161.html> — go read up, bestie, iykyk ✨

Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, no notes 💅 this was version 4.0.3, dated 2026-09-29, living its best life as TSGET(1SSL). go send some timestamp requests and slay 🎀✨🦋

📦 where this page comes from