The timestamp command allows you to timestamp one or more previously-signed files using a timestamp server. It supports fallback timestamp servers and can timestamp multiple files efficiently with wildcard support.
Supported file types: Authenticode (.exe, .dll, .msi, .cat, etc.), CMS (.mobileconfig, .mobileprovision, .provisionprofile), NuGet (.nupkg), VSIX (.vsix), and RDP (.rdp). ClickOnce/VSTO manifests cannot be timestamped after signing; their timestamps must be added during signing.
Files that are not yet signed are skipped with an informational message.
SignotaurTool.exe timestamp [options] <files>
A list of file paths to timestamp. You can specify individual file paths or use wildcards to match multiple files. This parameter supports the following wildcard patterns:
*: Matches zero or more characters within a file name. For example, *.exe will match all executable files in the specified directory.?: Matches a single character. For instance, file?.dll will match file1.dll, file2.dll, but not file12.dll.**: Indicates a recursive search across all subdirectories. For example, **/*.exe will match all .exe files found in the current directory and all its subdirectories.!: Identifies an exclude pattern. This must be at the start of the pattern. It must be used in conjunction with a normal include pattern. For instance, the two patterns *.dll and !*.Test.dll will match all .dll files found in the current directory excluded all test dlls, that is file1.dll, file2.dll, but not file1.Test.dll.Examples:
*.exe: Matches all executable files in the specified directory.C:\Projects\**\*.dll: Matches all dynamic link library files in the C:\Projects directory and any of its subdirectories.C:\MyFiles\file?.exe: Matches any executable files that start with "file" followed by a single character.!*.pdb: Matches all debug files in the specified directory from the current match.Notes:
--file-list option to specify the path to a file containing the list of file paths.--tr, --timestamp-server <TimeStampServer>
Required. Specifies the URL of the RFC 3161 timestamp server.
--td, --timestamp-digest <DigestAlgorithm>
Required. Specifies the digest algorithm used by the RFC 3161 timestamp server. Supported algorithms include: SHA256, SHA384, and SHA512.
--fb, --fallback-timestamp-servers <ServerList>
Specifies a comma-separated list of fallback timestamp servers to use if the primary server is unavailable. This provides reliability in the event of a primary server failure. Provide multiple servers by repeating this option. The servers are tried sequentially, stopping at the first successful response.
-m, --max-degree-of-parallelism <MDOP>
Specifies the maximum number of concurrent file timestamping operations. This setting allows you to control the degree of parallelism to optimize performance. The default value is 4, but you can adjust this based on the capabilities of your machine.
--fl, --file-list <FileName>
Specifies the path to a file containing a list of file paths to timestamp. This is helpful for handling multiple files at once without specifying each one in the command line. Each line in the file should contain one file path.
-b, --base-directory <Directory>
Sets the base directory for resolving relative file paths.
--cf, --continue-on-fail
Continues timestamping subsequent files even if an error occurs while timestamping a file. This option is useful for batch timestamping scenarios.
--encoding <Encoding>
Specifies the output encoding. Set to one of UTF8, UTF16, OEMCodePage or CodePage### where ### is the number of the code page to use. Defaults to UTF8.
--theme <Theme>
Specifies the console colour theme. Options are: General (default, suitable for most consoles), Dark (optimized for dark backgrounds), Light (optimized for light backgrounds), or None (disables colours). The default is General.
--nc, --no-colour, --no-color
Disables coloured output entirely. This is useful for CI/CD environments, log files, or systems that don't support ANSI colour codes. Alternatively, you can set the NO_COLOR environment variable to any non-empty value to achieve the same effect (following the no-color.org standard).
`--nb
Hides the banner in the output, which may be useful for scripting or logging purposes where you want a clean output.
-v, --verbose
Enables verbose logging for the timestamping operation, providing detailed output of the process, which can be useful for debugging.
--help
Displays help information and usage instructions for this command.
Timestamp multiple files:
SignotaurTool.exe timestamp -t <Thumbprint> --tr <TimeStampServer> --td SHA256 file1.exe file2.dll
Timestamp files with a primary and fallback timestamp servers:
SignotaurTool.exe timestamp --tr <TimeStampServer> --td SHA256 --fb <FallbackServer1> --fb <FallbackServer2> file1.exe file2.dll
Timestamp a previously signed RDP file:
SignotaurTool.exe timestamp --tr <TimeStampServer> --td SHA256 connection.rdp
The timestamp command can add or refresh an RFC 3161 timestamp on files that are already signed. It auto-detects the signature format and timestamps accordingly:
.appx, .appxbundle, .cab, .cat, .cdxml, .dll, .eappx, .eappxbundle, .emsix, .emsixbundle, .exe, .msi, .msix, .msixbundle, .msm, .msp, .mst, .ocx, .ps1, .ps1xml, .psd1, .psm1, .stl, .sys, .vbs, .vxd, .winmd. Additional PE file types may also be timestamped automatically.
.mobileconfig, .mobileprovision, .provisionprofile.
.nupkg — adds an RFC 3161 timestamp to the existing author signature inside the package.
.vsix — adds an RFC 3161 timestamp to the existing OPC XML signature inside the package.
.rdp — adds an RFC 3161 timestamp to the detached CMS signature embedded in the file's signature:s: line. The 12-byte Microsoft header is stripped, the CMS is timestamped, and the header is re-applied before the file is rewritten atomically.
The timestamp is correctly embedded in the CMS (and is honoured by Signotaur's own verify command and by general-purpose CMS inspection tools), but Microsoft Remote Desktop Connection itself does not consult it — once the signing certificate expires, the file reverts to an untrusted state regardless. See Timestamping and certificate expiry for details and the recommended approach to managing certificate renewal.
See RDP file signing for the broader signing workflow.
Files that are not yet signed are skipped with an error.
The following exit codes indicate the result of the operation performed by SignotaurTool.exe timestamp. The most common failure is 47 TimeStampError. Codes 16–58 reach the timestamp command via the Windows SignerTimeStampEx3 API for Authenticode files (.exe, .dll, .msi, etc.) and via the managed timestamper for CMS, NuGet, VSIX, and RDP files; any HRESULT the Windows API can return is mappable here.
--timestamp-server is required, at least one input file must be supplied), or an argument is malformed (E_INVALIDARG).--file-list file.SignatureValue is missing (CERT_E_MALFORMED).Typically a more specific message will be displayed before an error exit code is returned.