mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-11-09 12:32:52 +00:00
A timestamp counted as trusted time whenever its signer's certificate chained to a trusted certificate, whatever the certificate was issued for. Any key from a trusted CA could then vouch for an arbitrary time. Trusted time, for a document timestamp and for a signature's embedded one, now also needs a certificate whose extended key usage includes timeStamping, whose key usage allows signing, and which has no critical extension PdfCraft doesn't process (RFC 3161 §2.3). The test timestamp authority gets such a certificate.