checkId: doctor.evidence.timestamp.tsa.chain-valid family: doctor-check/v1 service: evidence-web scope: installation severity: critical tags: [timestamping, tsa, certificate-chain, eku, evidence]

TSA Certificate Chain Valid

Stella Ops is self-hosted software. It does not issue electronic time stamps or provide any qualified trust service. This deployment performs local verification using operator-supplied evidence. Unless an approved jurisdiction-, provider-, service-, and deployment-specific claim profile applies, qualified status is not determined.

Builds the TSA signer’s certificate chain at the verification time and requires it to terminate at a trusted anchor, to carry the RFC 3161 timestamping extended key usage, and to build with no status flags. Default severity when it fails: critical. Installation-scoped: one result per estate, served on the Evidence doctor path and probed on the worker schedule chain-posture (daily).

What it measures

• Chain built; anchored in a trusted root from the validated trust material.
• Timestamping EKU present on the signer (a chain that builds without it is a chain to the wrong kind of key).
• No chain status flags (for example revoked, not-time-valid, untrusted root).

The check never reports a pass for a value it does not have. When its source cannot be read it reports unhealthy with the message Source unavailable (<reason>): <detail>. No verdict can be reported. and the evidence keys source.state=unavailable, source.reason (one of source-not-configured, source-configuration-invalid, unavailable-by-sealed-policy, source-material-invalid, source-read-failed) and source.detail.

Evidence keys

• chain.built
• chain.anchoredInTrustedRoot
• chain.timestampingEkuPresent
• chain.statuses
• chain.verificationTime
• chain.mode

Every value is a bounded measurement or pointer; no token bytes, trust material or credentials appear in evidence.

Common causes

• The signer’s issuer is not in the trust material.
• The signer certificate lacks the timestamping EKU.
• An intermediate is missing from the token and from the trust material.

Configuration

Trust material never comes from a configured date or a bare URL. Online estates may point the TSA path at a PEM anchor file (Evidence__TimestampAssurance__Adapters__TrustAnchorBundlePath); a sealed estate mounts the OfflineKit timestamp-trust-bundle/v1 artifact, which is signature-verified before any part of it is read:

Evidence__TimestampAssurance__TrustBundle__BundleDirectory: "/mnt/offline-kit/timestamp-trust-bundle"
Evidence__TimestampAssurance__TrustBundle__Anchors__0__KeyId: "offline-kit-2026"
Evidence__TimestampAssurance__TrustBundle__Anchors__0__PublicKeyPemFilePath: "/mnt/offline-kit/keys/offline-kit-2026.pub"
Evidence__TimestampAssurance__TrustBundle__AcceptedProducers__0: "stellaops-offline-kit"
Evidence__TimestampAssurance__TrustBundle__RequiredRevocationKinds__0: "crl"

With a bundle configured, trust anchors and the revocation snapshot are answered from the artifact and the TSA-path measurements from the local responder; a bundle that fails validation makes every artifact-dependent check unavailable with reason source-material-invalid and the rejection code as detail. A replaced artifact is re-read within a minute.

How to verify

The 17 installation checks are served by evidence-web on the shared doctor-check/v1 path and need the ops.health scope. Probe the service DIRECTLY from inside the estate network: the gateway’s unprefixed /doctor/evidence/checks resolves to whichever service registered that template first, not to Evidence.

curl -sS -H "Authorization: Bearer $OPS_HEALTH_TOKEN" \
  http://evidence-web.stella-ops.local:8080/doctor/evidence/checks \
  | jq '.checks[] | select(.checkId == "doctor.evidence.timestamp.tsa.chain-valid")'

Once the Evidence doctor registration is activated (it is off by default in a sealed estate), the same result is also visible through the Platform doctor aggregator under the evidence service.

Related checks

• TSA Signer Certificate Expiry (doctor.evidence.timestamp.tsa.cert-expiry)
• TSA Trust Anchor Expiry (doctor.evidence.timestamp.tsa.root-expiry)
• OCSP Responder (doctor.evidence.timestamp.revocation.ocsp-responder)

This is a local evidentiary classification of the token and issuing service at the stated time. It is not the output of a qualified validation or qualified preservation service and does not determine the legal effect of the underlying release, document, or transaction.