docusealco/docuseal · error · TimestampServerController::TimestampError

Invalid Timeserver

Error message

Invalid Timeserver

What it means

TimestampServerController#create validates a configured RFC 3161 timestamp authority by POSTing a real timestamp query to it; test_timeserver_url raises TimestampError when the response status is not exactly 200 or the body is blank. The controller rescues TimestampError (plus SocketError and OpenSSL::Timestamp::TimestampError) and shows the invalid_timeserver alert - the 'Invalid Timeserver' message you see. The feature itself is 404-gated on multitenant instances (self-hosted only).

Source

Thrown at app/controllers/timestamp_server_controller.rb:41

  end

  private

  def test_timeserver_url(url)
    req = OpenSSL::Timestamp::Request.new
    req.algorithm = HASH_ALGORITHM
    req.message_imprint = OpenSSL::Digest.digest(HASH_ALGORITHM, 'test')

    uri = Addressable::URI.parse(url)

    conn = Faraday.new(uri.origin) do |c|
      c.request :authorization, :basic, uri.user, uri.password if uri.password.present?
    end

    response = conn.post(uri.path, req.to_der,
                         'content-type' => 'application/timestamp-query')

    raise TimestampError if response.status != 200 || response.body.blank?

    response
  end

  def load_encrypted_config
    @encrypted_config
  end

  def build_encrypted_config
    @encrypted_config =
      EncryptedConfig.find_or_initialize_by(account: current_account,
                                            key: EncryptedConfig::TIMESTAMP_SERVER_URL_KEY)

    @encrypted_config.assign_attributes(encrypted_config_params)
  end

  def encrypted_config_params
    params.require(:encrypted_config).permit(:value)

View on GitHub (pinned to 004a22c1c8)

Solutions

1. Reproduce outside the app: build a timestamp query and POST it with curl, expecting HTTP 200 and DER bytes back.
2. Use an https:// URL on port 443 and embed basic-auth credentials as user:pass@host if the TSA requires them (the code parses uri.user/uri.password).
3. Verify DNS and egress from the app host to the TSA.
4. Test with a known-good public TSA to isolate configuration from connectivity.

uri = Addressable::URI.parse(url)
raise ArgumentError, 'TSA URL must be HTTPS on 443' unless uri.scheme == 'https' && [443, nil].include?(uri.port)

rescue TimestampError, SocketError, OpenSSL::Timestamp::TimestampError
  redirect_back fallback_location: settings_notifications_path, alert: t('invalid_timeserver')

When it happens

Trigger: Saving a TSA URL that is wrong, unreachable, or returns an error page (401/403/500); a TSA that requires auth not embedded in the URL; redirects to HTML; non-compliant endpoints answering 200 with an empty body; DNS/egress blocking the TSA host (surfaces as the sibling SocketError).

Common situations: Typo'd or http:// TSA URL; corporate firewalls blocking the TSA; switching TSA providers with different auth requirements; internal TSAs without public certificates.

Related errors

• Too old
• In future

AI-assisted analysis of docusealco/docuseal@004a22c1c8 (2026-08-21). Data as JSON: /api/errors/d37d3c315481191d. Report an issue: GitHub.