checkId: check.timestamp.evidence.tst.expiry plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, evidence, tst, expiry]

TST Approaching Expiry

This Stella Ops Doctor check is the focused early-warning signal for individual timestamp tokens (TSTs) whose signing certificate is nearing end-of-life. It is aimed at platform operators who need to re-timestamp release evidence before its temporal proof lapses. For the rolled-up view across all evidence-staleness dimensions, see Evidence Staleness.

What It Checks

Detects timestamp tokens approaching signing certificate expiry:

Fails (unhealthy) if any timestamp is within the critical window (default 90 days).
Warns (degraded) if any timestamp is within the warning window (default 180 days).

Why It Matters

Expired timestamp tokens cannot be validated by relying parties. Artifacts with expired timestamps lose their temporal proof, which may invalidate compliance evidence.

Common Causes

TSA signing certificates approaching end-of-life
Re-timestamp jobs not scheduled or failing

How to Fix

Run the retimestamp workflow to refresh expiring artifacts:

stella retimestamp run --expiring-within 180d

Schedule automatic re-timestamping before expiry.

Verification

stella doctor run --check check.timestamp.evidence.tst.expiry

Evidence Staleness (check.timestamp.evidence.staleness) — aggregated evidence staleness check
TSA Certificate Expiry (check.timestamp.tsa.cert-expiry) — checks TSA certificate expiry