checkId: check.timestamp.tsa.reachable plugin: stellaops.doctor.timestamping severity: fail tags: [timestamping, tsa, availability, connectivity, air-gap]
TSA Availability
This Stella Ops Doctor check verifies that the configured Time Stamp Authority (TSA) endpoints are reachable and responding. It is most relevant to operators running policy-gated release pipelines, where unreachable TSAs stop new evidence from being timestamped and block any release that requires a verifiable timestamp. This is a fail-severity check.
What It Checks
Verifies that configured TSA (Time Stamp Authority) endpoints are reachable and responding. The check:
- Probes each endpoint from the
TsaEndpointsconfiguration via HTTP HEAD requests. - Considers HTTP 2xx and 405 (Method Not Allowed) as healthy responses (405 means the TSA is alive but only accepts POST).
- Reports the count of healthy vs. unhealthy endpoints.
- Degrades if no endpoints are configured. Fails if no endpoints are reachable. Warns if some are down.
Air-Gap Behavior
When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, Doctor does not probe external TSA endpoints. Instead, the check consults the typed offline-kit artefact registry (IAirGapArtefactStore, see docs/modules/doctor/architecture.md § Air-Gap Awareness) and validates that a TSA chain is shipped for every configured qTSP endpoint name (key: tsa-chains/<qtsp>.pem). On match, the check emits Healthy with the canonical evidence rows airGapSealed=true, source=offline-kit, artefactSha256=…, artefactIssuedAt=…. When no chain is shipped for any configured qTSP, the check fails closed with source=offline-kit-missing and a remediation message naming the expected file path — sealed mode without the offline kit must not silently pass.
The TSA-chain cache TTL is 24 hours. Manifest tampering is detected on every read (SHA-256 verification) and surfaces as offline-kit-missing, identical to a missing artefact.
Why It Matters
TSA endpoints provide RFC-3161 timestamps that anchor release evidence in time. If no TSA is reachable, new evidence cannot be timestamped, blocking policy-gated releases that require verifiable timestamps. This is a critical-severity check.
Common Causes
- TSA endpoint server is down or unreachable
- Network connectivity issues or firewall blocking HTTPS
- DNS resolution failure
- TSA provider maintenance or outage
How to Fix
Docker Compose
environment:
Timestamping__TsaEndpoints__0__Name: "FreeTSA"
Timestamping__TsaEndpoints__0__Url: "https://freetsa.org/tsr"
Timestamping__TsaEndpoints__1__Name: "DigiCert"
Timestamping__TsaEndpoints__1__Url: "http://timestamp.digicert.com"
Bare Metal / systemd
{
"Timestamping": {
"TsaEndpoints": [
{ "Name": "FreeTSA", "Url": "https://freetsa.org/tsr" },
{ "Name": "DigiCert", "Url": "http://timestamp.digicert.com" }
]
}
}
Test connectivity:
curl -I https://freetsa.org/tsr
Kubernetes / Helm
timestamping:
tsaEndpoints:
- name: "FreeTSA"
url: "https://freetsa.org/tsr"
- name: "DigiCert"
url: "http://timestamp.digicert.com"
Verification
stella doctor run --check check.timestamp.tsa.reachable
Related Checks
- TSA Response Time (
check.timestamp.tsa.response-time) — measures TSA response latency - TSA Valid Response (
check.timestamp.tsa.valid-response) — verifies the TSA returns valid RFC-3161 responses - TSA Failover Readiness (
check.timestamp.tsa.failover-ready) — confirms backup TSA endpoints for failover
