BetaPublic Mood is in beta. Get free beta access
publicmood
Get it free

Register

DigiCert timestamps

DigiCert is one of the two independent timestamp services that timestamp every Public Mood analysis we deliver. This page explains what DigiCert stamps for us and how you can check a DigiCert receipt yourself.

Who DigiCert is

DigiCert, Inc. is a US company that issues digital certificates. It runs a public timestamp service under the open RFC 3161 standard. DigiCert describes the service as providing "proof that the data existed at a particular moment in time and that it has not changed". We use this public service just as anyone else can; DigiCert does not review, approve or endorse our analyses.

What DigiCert stamps for us

At delivery we make a fingerprint list (manifest.sha256) with the digital fingerprints (SHA-256) of three files: the PDF, the data file and a locked copy of the report page. DigiCert receives only the fingerprint of that list. It never receives the files, their content, the topic of the analysis or who ordered it, and a fingerprint reveals nothing about the content of a file.

Why two independent services?

Every analysis is timestamped by two independent timestamp services, normally DigiCert and Sectigo. They are separate companies with separate certificates. If one of the receipts can no longer be checked one day, the other still can, and neither we nor any single service can quietly change an analysis or backdate a new version without it showing. If a reserve service is ever used instead, the register shows the service that was actually used for that analysis.

What the receipt contains

The DigiCert receipt (manifest.digicert.tsr) is a small signed file. In plain words, it contains:

  • the fingerprint of our fingerprint list,
  • the time DigiCert stamped it,
  • DigiCert's digital signature over both,
  • DigiCert's certificate, which says who signed it.

If a single character in the fingerprint list changes, the receipt no longer matches.

How long the certificates are valid

DigiCert replaces the certificates that sign its receipts at least once every 15 months. A new certificate only signs new receipts; every receipt keeps the certificate it was signed with. The certificate details will be shown here once the first receipt has been issued. Each register entry shows the stamped time, so you can still check a receipt after a certificate has expired (see step 4).

How to check a DigiCert receipt

You need OpenSSL and the files from the analysis's entry in the register: the fingerprint list (manifest.sha256), the DigiCert receipt (manifest.digicert.tsr) and the DigiCert certificate chain (digicert-chain.pem).

1. Check the files against the fingerprint list. Put the files you want to check next to manifest.sha256 and run sha256sum -c manifest.sha256 (macOS: shasum -a 256 -c manifest.sha256). See How to check an analysis for Windows.

2. Check the receipt with the chain from the register.

openssl ts -verify -data manifest.sha256 -in manifest.digicert.tsr -CAfile digicert-chain.pem

"Verification: OK" means DigiCert confirms the fingerprint list existed at the stamped time. To see that time, run openssl ts -reply -in manifest.digicert.tsr -text.

3. Check it against DigiCert's own root certificate (optional). If you would rather not rely on the chain file from us, download DigiCert Trusted Root G4 from DigiCert at cacerts.digicert.com/DigiCertTrustedRootG4.crt, then run:

openssl x509 -inform der -in DigiCertTrustedRootG4.crt -out digicert-root.pem
openssl x509 -in digicert-root.pem -noout -fingerprint -sha256
openssl ts -verify -data manifest.sha256 -in manifest.digicert.tsr -CAfile digicert-root.pem -untrusted digicert-chain.pem

The fingerprint should be 55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88. "Verification: OK" then means the receipt leads back to DigiCert's own root.

4. Years from now. After the certificates have expired, check at the stamped time:

T=$(date -ud "$(openssl ts -reply -in manifest.digicert.tsr -text | sed -n 's/^Time stamp: //p')" +%s)
openssl ts -verify -data manifest.sha256 -in manifest.digicert.tsr -CAfile digicert-chain.pem -attime "$T"

What the timestamp proves

The timestamp proves one thing: that the files are unchanged since delivery. It does not prove that the analysis is right. For that, read the method section in each analysis and our method page. Every analysis has sources of error, and we always do our best to state them.

More