checkId: check.timestamp.tsa.chain-valid plugin: stellaops.doctor.timestamping severity: fail tags: [timestamping, tsa, certificate, chain, validation]

TSA Certificate Chain Validity

This Stella Ops Doctor check ensures every configured TSA certificate chain is complete and trusted from leaf to root, so timestamps can be verified end-to-end. It is most relevant to operators running compliance-sensitive release pipelines, where an incomplete chain causes relying parties to reject otherwise valid evidence. This is a fail-severity check.

What It Checks

Ensures TSA certificate chains are valid and complete. The check:

Why It Matters

An incomplete or broken certificate chain means TSA timestamps cannot be verified end-to-end. Relying parties will reject evidence with unverifiable chains, causing compliance audit failures and blocking release promotions. This is a critical-severity check.

Common Causes

How to Fix

Docker Compose

# Verify chain manually
openssl verify -CAfile /certs/root.pem -untrusted /certs/intermediate.pem /certs/tsa-leaf.pem

# Update chain configuration
docker exec <platform-container> stella tsa chain update --name "Provider" \
  --cert /certs/tsa-leaf.pem --intermediate /certs/intermediate.pem

Bare Metal / systemd

stella tsa chain validate --all
stella tsa chain update --name "Provider" \
  --cert /path/to/leaf.pem --intermediate /path/to/intermediate.pem

Kubernetes / Helm

timestamping:
  chainValidation:
    enabled: true

Update certificate chain secrets:

kubectl create secret generic tsa-chain \
  --from-file=leaf.pem --from-file=intermediate.pem --from-file=root.pem

Verification

stella doctor run --check check.timestamp.tsa.chain-valid