Description of filters in Nexus Timestamp Server

logger.name

A unique name used for this logger.

String

${service}

handler.type

Optional. A logging handler type.

timerolling

-

handler.pattern

Optional. A log file name pattern. Can be used to introduce per timestamp service audit logging.

String

-

audittimestamprequest

Optional. Set to true if the timestamp request shall be logged.

true/false

false

audittimestampresponse

Optional. Set to true if the timestamp response shall be logged.

true/false

false

audittimestampclientip

Optional. Set to true if the client IP address shall be logged.

true/false

false

clock.type

The type of clock to inject.

virtual, real

real

clock.time

Applicable only if clock.type=virtual. The number of milliseconds past since the epoch (seconds since midnight 1 jan 1970).

Number

-

seconds

Number of seconds.

Number

0

milliseconds

Number of milliseconds between 1-999.

Number

0

digestalgorithm

The digest algorithm used to hash the message.

SHA-1, SHA-256, SHA-512

SHA-256

ordering

Ordering as defined in RFC3161.

true/false

false

usesubject

Used to decide if the Subject shall be used for GeneralName in the Timestamp. Only one of this and the following parameters shall be set at the same time or non of them.

true/false

false

usesubjectaltname

Used to define the SubjectAltName to use for GeneralName in the Timestamp

0=OtherName,

1=Rfc822Name,

2=DnsName,

3=X400Address,

4=DirectoryName,

5=EdiPartyName,

6=Uri,

7=IpAddress,

8=RegisteredId

-1, means that SubjectAltName is not used.

tsaname

Used to define a static name as GeneralName in the Timestamp.

true/false

-

storage 

Set this parameter if information shall be stored in the same database as other timestamp services. A value of "system" corresponds to use the same database as other timestamp services else this parameter shall not be set.

String

-

storage.database.jdbcDriver

The JDBC driver class.

String

-

storage.database.jdbcUrl

The JDBC URL or path to a file.

String

-

storage.database.jdbcUser

The user accessing the database.

String

-

storage.database.jdbcPassword

The users password.

String

-

digest

The digest algorithm used to hash the signature.

SHA-1, SHA-256, SHA-512

SHA-256

certIDHashAlgorithm

The hash algorithm used in the signer certificate to generate the identifier value. Uses ESSCertID according to  RFC3161 as default. If specified, it will use ESSCertIDv2 according to RFC 5816.

SHA-1, SHA-256, SHA-512 and more (ESSCertIDv2).

SHA-1 (ESSCertID)

policy

Specifies the policy used to create a timestamp response.

String

-

ntpUrl.<N>

The NTP servers' URLs to compare against.

String

-

ntpMinValid

The minimum required NTP servers that has to pass in order for the timestamp to be considered valid. If set to 0, all NTP servers have to pass.

Number

0

ntpUpdateFreq

Specifies the time, in seconds, how frequently the NTP server times should be updated. If set to 0, the NTP server times are updated on demand (not recommended).

Number

30

ntpUpdateLog

Specifies which NTP server update status that should be logged during each update.

Mask (passed, failed, none)

passed | failed

ntpAccuracy

The accuracy, in milliseconds, to compare the NTP times against during each update. If set to 0 this accuracy check is disabled.

Number

1000

ntpTimeout 

Specifies the time out, in milliseconds, of an NTP request. If a server times out, it will be marked as failed during that sequence update (invalid).

Number

500

truststore

Path to the trusted store to verify towards.

Path

-

addissuers

The issuers found in the store should be added to the context so that they are available for filters executing after the certificate verification filter.

true/false

false

checktime

If set to false, disables the control of the certificate's validity time.

true/false

true

validator.cache 

Name of the shared cache (defined in timestamp.properties).

Path

-

validator.cache.directory

Where downloaded CRLs are stored.

Path

-

validator.cache.truststore 

Where trusted CRL issuers are stored.

Path

-

validator.cache.maxAge

Defines the maximum age in seconds. A value of -1 corresponds to unlimited.

Number

-1

validator.cache.provider.<N>.type

Type of CRL provider.

pull

pull

validator.cache.provider.<N>.period

The time the thread should wait until it tries to fetch a new CRL.

ISO 8601 time expression, period.

PT1H

validator.cache.provider.<N>.margin

Specifies how long before "nextUpdate" to issue a new fetch.

ISO 8601 time expression, period.

PT3S

validator.cache.provider.<N>.fetcher.<M>.url

URL to fetch CRL from, <M> is the sequence number of possible URLs for this thread.

URL, no URL encoding needed.

-

signer.password

The password for the key.

String

-

signer.store

Path to p12 or jks. If a password is needed to decrypt a PKCS#12 file, it is passed after the filename, separated by a colon.

Path

-

signer.store.pin

The PKCS#12 file password.

String

-

signer.alias

The name of the key in the store. If there is only one key in the store, it can be omitted.

String

-

truststore

Directory with trusted root certificates, or name of service wide or server wide shared trust store.

Path, String

-

responder.< N>.url

Responder url for responder N in a list of responders.

URL

-

ocsp.signRequest

Specifies if requests to the OCSP server should be signed.

true/false

true

ocsp.allowTrustedSigners

If true, enables “direct trust”, where an OCSP responder certificate is trusted if it is present in the trust store.

true/false

false

ocsp.allowCriticalExtensions

Specifies if OCSP responses with critical extensions should be accepted.

true/false

false

ocsp.compareNonce

Specifies whether to compare the nonce from the OCSP request in the OCSP response or not.

true/false

true

ocsp.responder.< N>.url

Responder URL for responder N in a list of responders. If URL has scheme https, the ocsp.ssl parameters need to be configured.

URL

-

propagateResponse

Enables returning of the OCSP response to the application.

true/false

false

ocsp.allowIndirectDelegation

Allows the responder certificate to be a delegate of a certificate in the trust store

true/false

false

ocsp.allowResponderRevocationCheck

If a responder is not in the trust store, or does not have the extension ocsp-nocheck in its responder certificate, enable this to allow checking the responder’s certificate for revocation.

true/false

false

ocsp.responsemaxage

Specifies the maximum interval in seconds that the “thisUpdate” attribute might differ from the system time. If set to-1 nocheck is performed.

Number, -1

-1

ocsp.producedatskew

Specifies the maximum interval in seconds that the “producedAt” attribute timestamp is allowed to differ from system time. If set to -1 no check is performed.

Number, -1

-1

ocsp.nextupdateskew

Specifies the maximum interval in seconds that the “nextUpdate” attribute might differ from the system time.

Number

120

ocsp.dontCheckResponderRevocation

Do not check the responder’s certificate for revocation, assume it is ok.

true/false

false

ocsp.useNonce 

Use nonce in the OCSP revocation request.

true/false

true

ocsp.signer.alias

The name of the key in the store; if there is only one key in the store, it can be left blank.

String

-

ocsp.signer.password 

The password for thekey.

String

-

ocsp.signer.store

Path to p12 or jks. If a password is needed to decrypt a PKCS#12 file, it is passed after the filename separated by a colon.

Path

-

ocsp.signer.store.pin

The PKCS#12 file password.

String

-

ocsp.truststore

Name of service wide or server wide shared trust store.

String

-

ocsp.doPost

If false, attempt to use HTTP GET. Uses POST anyway if the OCSP request is longer than 255 bytes.

true/false

true

ocsp.useAIA

Determines whether to use authority access information (AIA) for validation if it is defined in the certificate. Otherwise uses only the OCSP validation list.

true/false

true

ocsp.AIAFirst

Determines whether the request should be validated towards the AIA before the OCSP validation list.

true/false

true

checkResponderExpiration

Determines whether to check if the signer certificate of the OCSP response from the responder has expired.

true/false

true

ocsp.ssl.trust

Directory with trusted root certificates for the TLS handshake.

Path

-

ocsp.ssl.keys

Path to PKCS#12 file which holds the client key and certificate chain for the TLS handshake.

Path

-

ocsp.ssl.pin

The PKCS#12 file password.

String

-

ocsp.verifyHostname

Toggle hostname verification in the TLS handshake.

true/false

true

ocsp.socketTimeout

Determines the socket timeout value (seconds) for the connections.

Number

10

ocsp.connectTimeout

Determines the timeout (seconds) until a new connection is fully established.

Number

10

ocsp.validateAfterInactivity

Defines period of inactivity (seconds) after which persistent connections must be re-validated prior to being leased to the consumer.

Number

10

ocsp.timeToLive

Defines the total span of time (seconds) connections can be kept alive or execute requests.

Number

60

ocsp.maxTotalConnections

Defines the maximum number of connections that can be open simultaneously.

Number

30

ocsp.maxTotalConnectionsPerRoute

Defines the maximum number of connections per route in the connection pool.

Number

15

validator.type

The validator type to use. first and roundrobin takes a list of validators to delegate to.

first, roundrobin, ocsp, crl

-

validator.validator.<N>.type

If validator.type=first. Will try the validators in this list in order until a definite answer is received. If validator.type=roundrobin. Will query the validators in a round robin fashion.

ocsp, crl

-

validator.validator.<N>.<param>

See the CrlValidationFilter or the ocsp parameter for the OcspValidationFilter (depending on type) for a specification of <param>s.

-

-