checkId: check.timestamp.tsa.reachable plugin: stellaops.doctor.timestamping severity: fail tags: [timestamping, tsa, availability, connectivity, air-gap]

TSA Availability

This Stella Ops Doctor check verifies that the configured Time Stamp Authority (TSA) endpoints are reachable and responding. It is most relevant to operators running policy-gated release pipelines, where unreachable TSAs stop new evidence from being timestamped and block any release that requires a verifiable timestamp. This is a fail-severity check.

What It Checks

Verifies that configured TSA (Time Stamp Authority) endpoints are reachable and responding. The check:

Air-Gap Behavior

When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, Doctor does not probe external TSA endpoints. Instead, the check consults the typed offline-kit artefact registry (IAirGapArtefactStore, see docs/modules/doctor/architecture.md § Air-Gap Awareness) and validates that a TSA chain is shipped for every configured qTSP endpoint name (key: tsa-chains/<qtsp>.pem). On match, the check emits Healthy with the canonical evidence rows airGapSealed=true, source=offline-kit, artefactSha256=…, artefactIssuedAt=…. When no chain is shipped for any configured qTSP, the check fails closed with source=offline-kit-missing and a remediation message naming the expected file path — sealed mode without the offline kit must not silently pass.

The TSA-chain cache TTL is 24 hours. Manifest tampering is detected on every read (SHA-256 verification) and surfaces as offline-kit-missing, identical to a missing artefact.

Why It Matters

TSA endpoints provide RFC-3161 timestamps that anchor release evidence in time. If no TSA is reachable, new evidence cannot be timestamped, blocking policy-gated releases that require verifiable timestamps. This is a critical-severity check.

Common Causes

How to Fix

Docker Compose

environment:
  Timestamping__TsaEndpoints__0__Name: "FreeTSA"
  Timestamping__TsaEndpoints__0__Url: "https://freetsa.org/tsr"
  Timestamping__TsaEndpoints__1__Name: "DigiCert"
  Timestamping__TsaEndpoints__1__Url: "http://timestamp.digicert.com"

Bare Metal / systemd

{
  "Timestamping": {
    "TsaEndpoints": [
      { "Name": "FreeTSA", "Url": "https://freetsa.org/tsr" },
      { "Name": "DigiCert", "Url": "http://timestamp.digicert.com" }
    ]
  }
}

Test connectivity:

curl -I https://freetsa.org/tsr

Kubernetes / Helm

timestamping:
  tsaEndpoints:
    - name: "FreeTSA"
      url: "https://freetsa.org/tsr"
    - name: "DigiCert"
      url: "http://timestamp.digicert.com"

Verification

stella doctor run --check check.timestamp.tsa.reachable