pkcs7 with timestamp

Question

I am looking at it for a day now, and I am still baffled. I want to add digital signature to a PDF with timestamp from a TSA (TimeStamp Authority).

I am okay with sending the request to a TSA and receiving a binary response, but how do I append that timestamp to my pkcs7 digital signature.

I am using PHP with TCPDF and the openssl_pkcs7_sign() function. Do I need to to add the timestamp as an extra certificate? Thanks!

Answer 1

I have created a simple library project called phpcmstimestamper precisely for this purpose, and you can use it like this:

<?php
$originalCmsAsPem = "-----BEGIN CMS-----
MIIFiAYJKoZIhvcNAQcCoIIFeTCCBXUCAQExDTALBglghkgBZQMEAgEwHQYJKoZI
...
1lUaWopfF7uZf5LXZt2Ru5UPr+51ULJRcEeUTA==
-----END CMS-----";
$updatedCms = CmsTimestamper::addTimestampToCms($originalCmsAsPem, "http://tsa.starfieldtech.com");

You can get more details and a fully working example at https://github.com/hablutzel1/phpcmstimestamper.