checkId: check.timestamp.eidas.trustlist.fresh plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, eidas, trustlist, lotl, compliance, air-gap]

EU Trust List Freshness

This Stella Ops Doctor check confirms that the cached EU Trust List (the LOTL – List of Trusted Lists) is recent enough to make sound eIDAS qualification decisions. It is aimed at operators of regulated, EU-facing release pipelines, where timestamps must come from currently qualified trust service providers.

What It Checks

Verifies that the EU Trust List (LOTL – List of Trusted Lists) is up to date. The check:

Queries the trust list cache for the last refresh timestamp.
Fails if the cache does not exist (trust list never fetched).
Fails if the cache is older than the critical threshold (default 7 days).
Warns if older than the warning threshold (default 3 days).
Reports the number of TSPs (Trust Service Providers) and QTS (Qualified TSAs) in the cache.

Air-Gap Behavior

When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, Doctor does not download the EU Trust List. The check consults the typed offline-kit artefact registry (IAirGapArtefactStore) and reads the LOTL XML from eu-trust-list/lotl.xml (plus per-member-state TSL XML from eu-trust-list/tsl/<country>.xml). On match the check emits Healthy with the canonical evidence rows airGapSealed=true, source=offline-kit, artefactSha256=…, artefactIssuedAt=…, plus memberStateCount and xmlDsigPresent. The LOTL provenance IssuedAtUtc becomes the authoritative “last refresh” timestamp; when it exceeds the warning/critical age windows the check downgrades to Degraded/Unhealthy with offline-kit provenance still attached. When no LOTL is shipped, the check fails closed (source=offline-kit-missing).

The EU Trust List cache TTL is 7 days. Manifest tampering is detected on every read (SHA-256 verification).

Why It Matters

The EU Trust List is the authoritative source for eIDAS-qualified trust service providers. A stale trust list may not reflect recent provider additions, withdrawals, or status changes, leading to incorrect qualification decisions for TSA providers operating under eIDAS regulation.

Common Causes

Trust list refresh job not running
Network issues preventing download from the EU publication endpoint
Air-gapped environment without scheduled trust list updates

How to Fix

Docker Compose

docker exec <platform-container> stella trust-list refresh

Bare Metal / systemd

stella trust-list refresh

# Schedule automatic refresh
stella trust-list schedule --interval 24h

Kubernetes / Helm

timestamping:
  eidas:
    trustListRefreshSchedule: "0 6 * * *"
    warningAgeDays: 3
    criticalAgeDays: 7

Verification

stella doctor run --check check.timestamp.eidas.trustlist.fresh

QTS Providers Qualification (check.timestamp.eidas.qts.qualified) — checks QTS provider qualification status
QTS Status Changes (check.timestamp.eidas.qts.status-change) — alerts on qualification status changes