checkId: check.timestamp.evidence.tst.missing-stapling plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, evidence, tst, stapling, ocsp]

TST Missing Stapling

This Stella Ops Doctor check finds timestamp tokens (TSTs) that lack embedded OCSP/CRL revocation proof. It matters most to operators of air-gapped or offline-first deployments: without stapled revocation data, a verifier must reach a live OCSP responder to confirm the signing certificate was valid — impossible behind an air gap, leaving the timestamp unverifiable. For the rolled-up view across all evidence-staleness dimensions, see Evidence Staleness.

What It Checks

Detects timestamps without stapled OCSP/CRL revocation data:

Fails (unhealthy) if the count of affected timestamps exceeds the critical threshold (default 10).
Warns (degraded) otherwise.

Why It Matters

Without stapled revocation data, verifiers must perform live OCSP/CRL lookups to confirm certificate validity. In air-gapped environments, these lookups are impossible, making the timestamp unverifiable. Stapling embeds proof-of-non-revocation directly in the timestamp token for offline verification.

Common Causes

TSA provider not configured to include stapled responses
OCSP stapling disabled in TSA configuration
Legacy timestamps created before stapling was enabled

How to Fix

Enable OCSP stapling and re-timestamp affected artifacts:

stella retimestamp run --with-stapling --filter missing-stapling

Ensure TSA providers are configured with stapling enabled.

Verification

stella doctor run --check check.timestamp.evidence.tst.missing-stapling

Evidence Staleness (check.timestamp.evidence.staleness) — aggregated evidence staleness check
OCSP Stapling Enabled (check.timestamp.ocsp.stapling) — checks OCSP stapling configuration