{"record":{"id":"d37d3c315481191d","repo":"docusealco/docuseal","slug":"invalid-timeserver","errorCode":null,"errorMessage":"Invalid Timeserver","messagePattern":"Invalid Timeserver","errorType":"exception","errorClass":"TimestampServerController::TimestampError","httpStatus":null,"severity":"error","filePath":"app/controllers/timestamp_server_controller.rb","lineNumber":41,"sourceCode":"  end\n\n  private\n\n  def test_timeserver_url(url)\n    req = OpenSSL::Timestamp::Request.new\n    req.algorithm = HASH_ALGORITHM\n    req.message_imprint = OpenSSL::Digest.digest(HASH_ALGORITHM, 'test')\n\n    uri = Addressable::URI.parse(url)\n\n    conn = Faraday.new(uri.origin) do |c|\n      c.request :authorization, :basic, uri.user, uri.password if uri.password.present?\n    end\n\n    response = conn.post(uri.path, req.to_der,\n                         'content-type' => 'application/timestamp-query')\n\n    raise TimestampError if response.status != 200 || response.body.blank?\n\n    response\n  end\n\n  def load_encrypted_config\n    @encrypted_config\n  end\n\n  def build_encrypted_config\n    @encrypted_config =\n      EncryptedConfig.find_or_initialize_by(account: current_account,\n                                            key: EncryptedConfig::TIMESTAMP_SERVER_URL_KEY)\n\n    @encrypted_config.assign_attributes(encrypted_config_params)\n  end\n\n  def encrypted_config_params\n    params.require(:encrypted_config).permit(:value)","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/docusealco/docuseal/blob/004a22c1c88109c7ba0b567df011a8cb13894001/app/controllers/timestamp_server_controller.rb#L23-L59","documentation":"TimestampServerController#create validates a configured RFC 3161 timestamp authority by POSTing a real timestamp query to it; test_timeserver_url raises TimestampError when the response status is not exactly 200 or the body is blank. The controller rescues TimestampError (plus SocketError and OpenSSL::Timestamp::TimestampError) and shows the invalid_timeserver alert - the 'Invalid Timeserver' message you see. The feature itself is 404-gated on multitenant instances (self-hosted only).","triggerScenarios":"Saving a TSA URL that is wrong, unreachable, or returns an error page (401/403/500); a TSA that requires auth not embedded in the URL; redirects to HTML; non-compliant endpoints answering 200 with an empty body; DNS/egress blocking the TSA host (surfaces as the sibling SocketError).","commonSituations":"Typo'd or http:// TSA URL; corporate firewalls blocking the TSA; switching TSA providers with different auth requirements; internal TSAs without public certificates.","solutions":["Reproduce outside the app: build a timestamp query and POST it with curl, expecting HTTP 200 and DER bytes back.","Use an https:// URL on port 443 and embed basic-auth credentials as user:pass@host if the TSA requires them (the code parses uri.user/uri.password).","Verify DNS and egress from the app host to the TSA.","Test with a known-good public TSA to isolate configuration from connectivity."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"uri = Addressable::URI.parse(url)\nraise ArgumentError, 'TSA URL must be HTTPS on 443' unless uri.scheme == 'https' && [443, nil].include?(uri.port)","typeGuard":null,"tryCatchPattern":"rescue TimestampError, SocketError, OpenSSL::Timestamp::TimestampError\n  redirect_back fallback_location: settings_notifications_path, alert: t('invalid_timeserver')","preventionTips":["Pre-test TSA URLs with curl before saving","Keep TSA credentials embedded in the URL current","Monitor TSA reachability from the app host"],"tags":["rfc3161","timestamp","tsa","configuration","ssl"],"backgroundTag":"rfc3161-timestamp-server-error","analyzedSha":"004a22c1c88109c7ba0b567df011a8cb13894001","analyzedAt":"2026-08-21T13:38:23.343Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}