Timestamping: Why Digital Signatures Need Timestamps
-
A timestamp records when your code was signed, so the signature stays valid after the code signing certificate expires. Here's how timestamping works, what happens without it, and how to add a timestamp when you sign.
-
-
*
What Is Timestamping?
When you sign software, the signature proves who published it and that the code hasn't been changed since. But a code signing certificate is only valid for a limited time, and without a timestamp, there's no proof that the signature was made while the certificate was still valid.
Timestamping solves this. During signing, a trusted Time Stamping Authority (TSA) adds a secure record of the exact date and time to your signature. Later, when someone installs or runs your software, their system can see that the code was signed while the certificate was valid and keeps trusting it.
Without a timestamp, the signature stops being valid as soon as the certificate expires. Users then see security warnings or an unknown publisher message, and some systems may block the installation entirely, even though the code itself hasn't changed.
-
*
How Timestamping Works
Timestamping happens automatically as part of signing, in a few steps:
- Your signing tool creates a hash of the signed file, a unique fingerprint of its contents.
- The hash is sent to the TSA's timestamp server. Only the hash is sent, never the software itself.
- The TSA adds the current date and time to the hash and signs the result with its own certificate. This creates a timestamp token.
- The token is returned to your signing tool and embedded in the file's signature.
When the software is checked later, the system verifies the timestamp using the TSA's certificate. It doesn't need to contact the timestamp server again.
-
*
When the Certificate Expires or Is Revoked
Expired certificate. If the signature has a timestamp, it stays valid after the certificate expires. Software you've already released keeps working without warnings. To sign new releases, you'll need a renewed certificate.
Revoked certificate. When a certificate is revoked, the CA records a revocation date. Signatures timestamped before that date generally stay valid, while signatures made after it are rejected.
Important: If a certificate is revoked because its private key was compromised, the CA can set the revocation date to the moment the compromise happened, which may be earlier than the date of revocation itself. Any signatures timestamped after that point become invalid, even if they were made before the certificate was actually revoked.
-
*
How to Add a Timestamp
Timestamp servers are free and publicly available, and you don't need a separate account to use them. You simply point your signing tool to the server's URL:
- DigiCert: http://timestamp.digicert.com
- Sectigo: http://timestamp.sectigo.com
For example, with Microsoft SignTool on Windows, the /tr option sets the timestamp server and /td sets the hash algorithm for the timestamp:
signtool sign /fd sha256 /tr http://timestamp.digicert.com /td sha256 /a MyApp.exe
Other signing tools, such as jarsigner for Java applications, have similar options.
Tip: Add a timestamp every time you sign. If you've already signed a file without one, you can add it afterwards with the signtool timestamp command, but only while your certificate is still valid.
Timestamping matters even more now that code signing certificates are valid for a maximum of 460 days. See Code Signing 2026 Industry Changes.
-
