I'm currently working on Timestamping and stumbled upon a parameter fRequestCerts/requestSignerCertificates/certReq that according to the documentation (1, 2) tells a TSA to include the certificate that was used to sign the timestamp token in its response.
When fiddling with this parameter I noticed that Windows behaves differently when validating self-signed TSA certificates. More specifically, when the parameter is set to true Windows apparently treats self-signed TSA certificates as trustworthy. When the parameter is set to false Windows treats them as non-trustworthy.
Unfortunately I couldn't find any more detailed information about this matter. So my questions are:
- Why exactly would I use this parameter?
- How does it influence trust?