Diploma revalidation
A digital diploma must remain verifiable for as long as its holder needs it, but every certificate behind its signatures expires: the certificates of the people and institutions who signed it, and the certificates of the timestamp authorities (ACTs) that timestamped those signatures. Revalidation (revalidação) is the periodic renewal of the diploma's archive timestamp, which keeps its signatures verifiable after all of them expire. Digiploma does it automatically and calls it restamping (Renotarização).
This page is about the signatures of digital diplomas. It is not about the revalidation of diplomas issued abroad, which is an academic process outside Digiploma.
Why signatures need revalidation
The signatures of DadosDiploma and DadosRegistro carry a signature timestamp, issued by an ICP-Brasil timestamp authority. The
timestamp proves when the signature was made, so the signature stays valid after the signer's certificate expires. But the timestamp is
itself signed, and it can be verified only while the certificate of the timestamp authority is valid. After that, nothing proves any
longer that the signatures existed before their certificates expired.
That is why the diploma XML ends with an archiving signature of the whole document, with the ICP-Brasil AD-RA policy. It covers
the whole file, including the signatures of DadosDiploma and DadosRegistro, stores the certificates and revocation lists (LCRs) that
validate it, and carries an archive timestamp. Before that archive timestamp expires, a new one, from a newer certificate, is added
over everything; and so on, for as long as the diploma must remain verifiable. The academic documentation XML follows the same rule (see
Who signs what).
The PKI SDK article AD-RT signature lifecycle shows this timeline, policy by policy.
How Digiploma revalidates
- When Signer concludes a document, Digiploma creates a restamp record for each signed file, with the date its archive timestamp expires: the end of validity of the timestamp authority's certificate in the last archive timestamp.
- Every night, a job picks the records that expire in less than 180 days (by default).
- For each one, Digiploma requests a new timestamp from its timestamp server and adds it as a new archive timestamp to the archiving signature. The renewed file replaces the one Digiploma keeps.
- Digiploma creates the next record, for the new expiration date. A restamp that fails is marked
WithErrorand retried on the following nights.
Digiploma revalidates diplomas (both XML files), final academic transcripts and second copies, curriculums and, when the instance enables it, registration requests. See Restamps for the details.
A renewal extends the expiration only if the new timestamp is signed by a different certificate of the timestamp authority than the previous archive timestamps. Otherwise the restamp fails and is retried on the following nights.
Follow the revalidation
- In the web application, the Renotarizações (Restamps) menu lists the records of the organization, and each diploma, transcript, curriculum and registration has a Renotarizações tab with its own records.
- In the API,
GET /api/restampslists the records, by status:NonRestamped(pending),RestampedorWithError. - The
RestampCreated,RestampUpdated,RestampAppliedandRestampApplyingErrorwebhooks report each step, when the instance enables them.
Download the files from Digiploma after they are revalidated: the copy in Signer does not have the new archive timestamps (see Where the signed files are).
On premises
Revalidation needs a timestamp server, under the Timestamper section of the settings, and is controlled by the Restamp section:
the advance (RestampDocumentsBeforeExpiringInDays, 180 days), the number of documents per run, and DisableRestamp, which turns it off
for the whole instance. See Restamp and timestamp settings. The instance
administrator can also turn it off for a single organization.