I’m trying to create a TSA using openssl 3. I created a private CA (in “ca” dir), then keys and certs for the TSA (“tsa” dir).

I have the following openssl config (tsa/openssl.cnf) for the TSA:

[ tsa ]
default_tsa = tsa_config1

[ tsa_config1 ]
dir                     = path/to/tsa
serial                  = $dir/serial
crypto_device           = builtin
signer_cert             = $dir/certs/tsa.cert.pem
certs                   = $dir/certs/ca.cert.pem
signer_key              = $dir/private/tsa.key.pem
default_policy          = tsa_policy1
other_policies          = tsa_policy2, tsa_policy3
digests                 = sha256
accuracy                = secs:1, millisecs:500, microsecs:100
ordering                = yes
tsa_name                = yes

[ tsa_cert ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = critical, timeStamping

[ tsa_policy1 ]
policy_identifier       = 1.2.3.4.1

I create a timestamp query, it’s fine:

openssl ts -query -data data.txt -no_nonce -out request.tsq
openssl ts -query -in request.tsq -text
Using configuration from /usr/lib/ssl/openssl.cnf
Version: 1
Hash Algorithm: sha256
Message data:
    0000 - f4 51 51 f5 25 3c 62 de-69 c9 59 35 f0 83 b5 64   .QQ.%<b.i.Y5...d
    0010 - 98 76 fd b6 61 41 2d 4f-32 06 5a 7b 01 8b f6 8b   .v..aA-O2.Z{....
Policy OID: unspecified
Nonce: unspecified
Certificate required: no
Extensions:

However, when I try to create a response, I got the following error:

openssl ts -config tsa/openssl.cnf -reply -queryfile request.tsq -out response.tsr
Using configuration from tsa/openssl.cnf
Response is not generated.
803BDC56027F0000:error:17800075:time stamp routines:TS_RESP_CTX_set_signer_cert:invalid signer certificate purpose:../crypto/ts/ts_rsp_sign.c:163:

What am I missing?