code: protected byte[] getTimeStampToken(byte[] imprint) throws Exception {
          byte[] respBytes = null;
          try {
              // Setup the time stamp request
              TimeStampRequestGenerator tsqGenerator = new TimeStampRequestGenerator();
              tsqGenerator.setCertReq(true);
              // tsqGenerator.setReqPolicy("1.3.6.1.4.1.601.10.3.1");
              BigInteger nonce = BigInteger.valueOf(System.currentTimeMillis());
              TimeStampRequest request = tsqGenerator.generate(X509ObjectIdentifiers.id_SHA1 , imprint, nonce);
              byte[] requestBytes = request.getEncoded();
              
              // Call the communications layer
              respBytes = getTSAResponse(requestBytes);
              
              // Handle the TSA response
              TimeStampResponse response = new TimeStampResponse(respBytes);
              
              // validate communication level attributes (RFC 3161 PKIStatus)
              response.validate(request);
              PKIFailureInfo failure = response.getFailInfo();
              int value = (failure == null) ? 0 : failure.intValue();
              if (value != 0) {
                  // @todo: Translate value of 15 error codes defined by PKIFailureInfo to string
                  throw new Exception("Invalid TSA '" + tsaURL + "' response, code " + value);
              }
              // @todo: validate the time stap certificate chain (if we want
              //        assure we do not sign using an invalid timestamp).
              
              // extract just the time stamp token (removes communication status info)
              TimeStampToken  tsToken = response.getTimeStampToken();
              if (tsToken == null) {
                  throw new Exception("TSA '" + tsaURL + "' failed to return time stamp token: " + response.getStatusString());
              }
  
              byte[] encoded = tsToken.getEncoded();
              
              // Update our token size estimate for the next call (padded to be safe)
              this.tokSzEstimate = encoded.length + 32;
              return encoded;
          } catch (Exception e) {
              throw e;
          } catch (Throwable t) {
              throw new Exception("Failed to get TSA response from '" + tsaURL +"'", t);
          }
      }
docs: Get timestamp token - Bouncy Castle request encoding / decoding layer