stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 3 Releases Wiki Activity
Files
bf20ffe3d237d6628cf4c23357924f502146bd18
git.stella-ops.org/docs/doctor/articles/timestamping/tst-missing-stapling.md
master c58a236d70 Doctor plugin checks: implement health check classes and documentation 
Implement remediation-aware health checks across all Doctor plugin modules
(Agent, Attestor, Auth, BinaryAnalysis, Compliance, Crypto, Environment,
EvidenceLocker, Notify, Observability, Operations, Policy, Postgres, Release,
Scanner, Storage, Vex) and their backing library counterparts (AI, Attestation,
Authority, Core, Cryptography, Database, Docker, Integration, Notify,
Observability, Security, ServiceGraph, Sources, Verification).

Each check now emits structured remediation metadata (severity, category,
runbook links, and fix suggestions) consumed by the Doctor dashboard
remediation panel.

Also adds:
- docs/doctor/articles/ knowledge base for check explanations
- Advisory AI search seed and allowlist updates for doctor content
- Sprint plan for doctor checks documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 12:28:00 +02:00

1.3 KiB
Raw Blame History

checkId, plugin, severity, tags
checkId plugin severity tags
check.timestamp.evidence.tst.missing-stapling stellaops.doctor.timestamping warn
timestamping
evidence
tst
stapling
ocsp

TST Missing Stapling

What It Checks

Detects timestamps without stapled OCSP/CRL revocation data. Fails if the count exceeds the critical threshold (default 10), otherwise warns.

Why It Matters

Without stapled revocation data, verifiers must perform live OCSP/CRL lookups to confirm certificate validity. In air-gapped environments, these lookups are impossible, making the timestamp unverifiable. Stapling embeds proof-of-non-revocation directly in the timestamp token for offline verification.

Common Causes

  • TSA provider not configured to include stapled responses
  • OCSP stapling disabled in TSA configuration
  • Legacy timestamps created before stapling was enabled

How to Fix

Enable OCSP stapling and re-timestamp affected artifacts:

stella retimestamp run --with-stapling --filter missing-stapling

Ensure TSA providers are configured with stapling enabled.

Verification

stella doctor run --check check.timestamp.evidence.tst.missing-stapling

Related Checks

  • check.timestamp.evidence.staleness — aggregated evidence staleness check
  • check.timestamp.ocsp.stapling — checks OCSP stapling configuration