---
title: "Configure Timestamping - Rest PKI"
description: "Configuring timestamping on an on-premises Rest PKI instance for policies such as PAdES-T and CAdES Ad-RT, using an external TSP service or the Rest PKI cloud."
canonical: "https://docs.lacunasoftware.com/en-us/articles/rest-pki/on-premises/configure-timestamping"
locale: "en"
product: "Rest PKI (legacy)"
last_updated: "2026-10-12"
---

# Configure Timestamping - Rest PKI

To perform digital signatures on your [*on premises*](https://docs.lacunasoftware.com/en-us/articles/rest-pki/on-premises) instance of [Rest PKI](https://docs.lacunasoftware.com/en-us/articles/rest-pki) with
signature policies that require a signature timestamp, for instance the **PAdES-T** or **CAdES Ad-RT** policies,
you need to hire an external timestamping service.

> **Note**
>
> You can use the Rest PKI cloud (https://pki.rest/) to provide timestamps to your Rest PKI instance.
> See the prices [here](https://www.lacunasoftware.com/en/pricing/#cloud-simulator).

The timestamping service must meet the following requirements:

* Communication through the *Timestamp Protocol* (TSP - RFC 3161) over HTTP or HTTPS
* One of the following authentication methods:
  * HTTP basic authentication
  * SSL/TLS with mutual authentication
  * OAuth Bearer Token

If you choose to use the Rest PKI cloud, follow the steps below to get the access credentials:

1. Sign in on the Rest PKI cloud website (https://pki.rest/)
1. On the Control Panel, click the **Generate new access token** button
1. Copy the generated value

If you choose another timestamp provider, ask the provider for the access details (URL and credentials).

Once you have the access details of the timestamp provider, follow the steps below to configure your
Rest PKI instance:

1. Access your Rest PKI instance
1. Sign in with the "Admin" user or another administrator user (the password was set during the installation)
1. On the top menu, go to **Administration** > **Timestamp Plans**
1. Click the *ICP-Brasil* item

   ![Select plan ICP-Brasil](https://docs.lacunasoftware.com/images/rest-pki/select-plan-icp-brasil.png)

1. In the **Timestamp Requesters** area, type a name and click **Create**

   ![Create timestamper](https://docs.lacunasoftware.com/images/rest-pki/create-timestamper.png)

1. On the next screen, fill in the provider's URL and click **Create**
   * For the Rest PKI cloud, the URL is: `https://pki.rest/tsp/a402df41-8559-47b2-a05c-be555bf66310`
1. Once the requester is created, open its settings

   ![Edit timestamper](https://docs.lacunasoftware.com/images/rest-pki/edit-timestamper.png)

1. On the **Authentication** field, choose the option specified by the provider
   * For the Rest PKI cloud, the option must be **OAuth Bearer Token**
1. Depending on your choice, a new field is shown and must be filled:
   1. *HTTP basic authentication*: fill the **Credentials** field with the username and password given by the provider
   1. *OAuth Bearer Token*: fill the **OAuth Token** field with the token given by the provider (**without** the "Bearer" prefix)
   1. SSL with mutual authentication: see the [section below](https://docs.lacunasoftware.com/en-us/articles/rest-pki/on-premises/configure-timestamping#ssl-mutual-auth)
1. Click the **Test** button. If a message says the test was successful, the configuration is correct.

## Authentication through SSL/TLS with mutual authentication

To use a timestamp provider that requires authentication through SSL/TLS with mutual authentication, you must first
import the certificate given by the provider into the Windows certificate store, in the Personal folder of the user
that runs Rest PKI.

With the .pfx file (PKCS #12) given by the provider at hand, follow one of the sections below, depending on the
environment where Rest PKI is installed, to import the certificate into the Windows store.

### Configuration on Windows Server

1. Access the server where Rest PKI is installed
1. Create a local user for Rest PKI
   1. On the start menu, search for "Edit local users and groups" and click it
   1. Right-click the Users folder and click **New User...**
   1. Fill in a username and a password
   1. Uncheck the option *User must change password at next logon*
   1. Check the option *Password never expires*
   1. Click **Create**
1. Grant the new user the required permissions on the Rest PKI installation folder
   1. Find the folder where Rest PKI is installed (e.g. `c:\inetpub\RestPKI`)
   1. Right-click the folder and go to the **Security** tab
   1. Click **Edit...** > **Add..** > type the name of the user you created and click **OK**
   1. Leave only the **List folder contents** and **Read** items checked
   1. Click **OK**
1. Change the identity of the *application pool*
   1. Open the *IIS Manager*
   1. Go to *Application Pools*
   1. Click the Rest PKI *application pool*
   1. Click **Advanced Settings...** on the right-hand menu
   1. In the **Process Model** section, edit the **Identity** setting
   1. Choose the **Custom account** option
   1. Click the **Set...** button and enter the credentials chosen for the user you created
   1. Click **OK**
1. Check that Rest PKI still works normally (access the web interface)
1. Browse to the `C:\Windows\System32` folder
1. Find the `mmc.exe` file
1. Hold the SHIFT key and right-click the file
1. Click the **Run as different user** option

   ![Run mmc.exe as different user](https://docs.lacunasoftware.com/images/rest-pki/run-mmc-as-different-user.png)

1. Enter the credentials of the user you created
1. Go to **File** > **Add/Remove Snap-in...**
1. Click **Certificates**, click the **Add >** button and click **OK**
1. Expand the **Certificates - Current User** folder
1. Right-click the **Personal** folder > **All Tasks** > **Import...**
1. Follow the *wizard*, providing the .pfx file and its password

Once the certificate is imported, it is listed on the **SSL Certificate** field of the timestamp provider settings in Rest PKI.

### Configuration on Azure App Service

1. Open the App Service settings on the Azure dashboard
1. Open the App Service's **SSL certificates**
1. Click **Upload Certificate**
1. Provide the .pfx file and its password and click **Upload**
1. When the operation finishes, the certificate appears on the list of certificates
1. Copy the value of the certificate's **Thumbprint** column
1. Open the App Service's **Application settings**
1. In the *Application settings* section, add a new setting
   * Name: `WEBSITE_LOAD_CERTIFICATES`
   * Value: (the value copied from the *Thumbprint* column)
1. Save the settings

Once the certificate is imported, it is listed on the **SSL Certificate** field of the timestamp provider settings in Rest PKI.