Configure Timestamping - Rest PKI

To perform digital signatures on your on premises instance of Rest PKI with signature policies that require a signature timestamp, for instance the PAdES-T or CAdES Ad-RT policies, you need to hire an external timestamping service.

note

You can use the Rest PKI cloud (https://pki.rest/) to provide timestamps to your Rest PKI instance. See the prices here.

The timestamping service must meet the following requirements:

• Communication through the Timestamp Protocol (TSP - RFC 3161) over HTTP or HTTPS
• One of the following authentication methods:
  • HTTP basic authentication
  • SSL/TLS with mutual authentication
  • OAuth Bearer Token

If you choose to use the Rest PKI cloud, follow the steps below to get the access credentials:

1. Sign in on the Rest PKI cloud website (https://pki.rest/)
2. On the Control Panel, click the Generate new access token button
3. Copy the generated value

If you choose another timestamp provider, ask the provider for the access details (URL and credentials).

Once you have the access details of the timestamp provider, follow the steps below to configure your Rest PKI instance:

1. Access your Rest PKI instance

2. Sign in with the "Admin" user or another administrator user (the password was set during the installation)

3. On the top menu, go to Administration > Timestamp Plans

4. Click the ICP-Brasil item

   

5. In the Timestamp Requesters area, type a name and click Create

   

6. On the next screen, fill in the provider's URL and click Create

   • For the Rest PKI cloud, the URL is: https://pki.rest/tsp/a402df41-8559-47b2-a05c-be555bf66310

7. Once the requester is created, open its settings

   

8. On the Authentication field, choose the option specified by the provider

   • For the Rest PKI cloud, the option must be OAuth Bearer Token

9. Depending on your choice, a new field is shown and must be filled:

   1. HTTP basic authentication: fill the Credentials field with the username and password given by the provider
   2. OAuth Bearer Token: fill the OAuth Token field with the token given by the provider (without the "Bearer" prefix)
   3. SSL with mutual authentication: see the section below

10. Click the Test button. If a message says the test was successful, the configuration is correct.

Authentication through SSL/TLS with mutual authentication

To use a timestamp provider that requires authentication through SSL/TLS with mutual authentication, you must first import the certificate given by the provider into the Windows certificate store, in the Personal folder of the user that runs Rest PKI.

With the .pfx file (PKCS #12) given by the provider at hand, follow one of the sections below, depending on the environment where Rest PKI is installed, to import the certificate into the Windows store.

Configuration on Windows Server

1. Access the server where Rest PKI is installed

2. Create a local user for Rest PKI

   1. On the start menu, search for "Edit local users and groups" and click it
   2. Right-click the Users folder and click New User...
   3. Fill in a username and a password
   4. Uncheck the option User must change password at next logon
   5. Check the option Password never expires
   6. Click Create

3. Grant the new user the required permissions on the Rest PKI installation folder

   1. Find the folder where Rest PKI is installed (e.g. c:\inetpub\RestPKI)
   2. Right-click the folder and go to the Security tab
   3. Click Edit... > Add.. > type the name of the user you created and click OK
   4. Leave only the List folder contents and Read items checked
   5. Click OK

4. Change the identity of the application pool

   1. Open the IIS Manager
   2. Go to Application Pools
   3. Click the Rest PKI application pool
   4. Click Advanced Settings... on the right-hand menu
   5. In the Process Model section, edit the Identity setting
   6. Choose the Custom account option
   7. Click the Set... button and enter the credentials chosen for the user you created
   8. Click OK

5. Check that Rest PKI still works normally (access the web interface)

6. Browse to the C:\Windows\System32 folder

7. Find the mmc.exe file

8. Hold the SHIFT key and right-click the file

9. Click the Run as different user option

   

10. Enter the credentials of the user you created

11. Go to File > Add/Remove Snap-in...

12. Click Certificates, click the Add > button and click OK

13. Expand the Certificates - Current User folder

14. Right-click the Personal folder > All Tasks > Import...

15. Follow the wizard, providing the .pfx file and its password

Once the certificate is imported, it is listed on the SSL Certificate field of the timestamp provider settings in Rest PKI.

Configuration on Azure App Service

1. Open the App Service settings on the Azure dashboard
2. Open the App Service's SSL certificates
3. Click Upload Certificate
4. Provide the .pfx file and its password and click Upload
5. When the operation finishes, the certificate appears on the list of certificates
6. Copy the value of the certificate's Thumbprint column
7. Open the App Service's Application settings
8. In the Application settings section, add a new setting
   • Name: WEBSITE_LOAD_CERTIFICATES
   • Value: (the value copied from the Thumbprint column)
9. Save the settings

Once the certificate is imported, it is listed on the SSL Certificate field of the timestamp provider settings in Rest PKI.