Release note Nexus Timestamp Server 2.2.1

QC statement parsing exception

A bug which caused failure in the QC statement parsing from the Timestamp Server response signer certificate is now fixed.

Broken TLSv1.3 with RSA in Java 11.0.12

Java 11.0.12 altered the way TLSv1.3 works with RSASSA-PSS based TLS certificates, which also affected regular RSA based TLS certificates. This is now fixed.

Java 11 Support

Nexus Timestamp Server now supports Oracle and OpenJDK Java 11. See Nexus Timestamp Server requirements and interoperability.

Removed Java 8 Support

Nexus Timestamp Server no longer supports Java 8.

Removed License Viewer WEB GUI

The License Viewer WEB GUI has been removed.

Removed Transaction Limiting

It is no longer possible to limit the amount of transaction based on the license.

RFC 5816 Support

Functionality has been added to support ESSCertIDv2, specified in ETSI 319 422. See https://tools.ietf.org/html/rfc5816. This option is configurable in the TimestampTokenFilter in service.properties. See Description of filters in Nexus Timestamp Server.

Network Time Protocol Support

The Timestamp server now supports NTP configuration to verify its local clock against UTC servers. A new filter, ntp.NTPFilter, has been added for this purpose in service.properties. See Description of filters in Nexus Timestamp Server. This is a requirement specified in ETSI 319 421.

Private Key Extension

Added support for validating the private key usage period from the TS signing certificate (if stated). This is specified in ETSI 319 421.

User Certificate Verification Filter Changes

Filters that verifies user certificates, for example validation.CertificateVerificationFilter and validation.OCSPValidationFilter now expects a user certificate to be sent through the chain. If no user certificate is provided, the filters will not continue and will throw an error. In other words, these filters requires SSL with client authentication enabled. See Description of filters in Nexus Timestamp Server.

HSM Pin Pad Support

Configuration has been added to timestamp.properties to support pin pad enabled HSMs. See Global service settings for Nexus Timestamp Server.

Filter updated

The filter GlobalClockFilter has changed name to ClockFilter and has been improved.

Name Change

The product has been renamed from Nexus Nano Timestamp Server to Nexus Timestamp Server. Traces of 'nano' may still be present.

Scrambling of sensitive parameters

It is now possible to scramble sensitive parameters in the configuration files by adding ".encrypted" at the end of the parameter. This is further described in the Administrator's Guide.

Hardware Token Setup

The tool hwsetup (Hardware Token Setup) is now bundled, making it easier to generate and use keys on an HSM. This is further described in the Administrator's Guide.

Windows Server support

Support has been added to run Timestamp Server on Windows Server.

Java8 64-bit

Timestamp Server has been updated to run on Java 8 and on a 64-bit JVM.

HSM Support

The HSM Support has been changed to make use of Nexus PKCS#11 in line with other PKI products from Nexus.