A collector buys a print of “Grues au crépuscule, Saint-Nazaire” by our fictional photographer, Jeanne Valory. With the print, the gallery hands her a certificate of authenticity: a PDF, with a QR code. She files it away. Ten years later she wants to sell the print, and the buyer asks: what is this certificate worth?
The honest answer comes in two lists: what the certificate attests, and what it does not. The first three articles in this series described what a catalogue raisonné holds: works, prints and their provenance, exports and metadata. This last one is about the document that leaves the catalogue to accompany an object.
We will use Obscura Catalog’s certificate as an example. The app has been available for download since version 0.9.0, on 14 October 2026, and version 0.10.0 refined several of the behaviours described below.
A certificate is a declaration
A certificate of authenticity is not a measurement. It is a declaration: someone states, in writing, that a given object is a given work by a given author. Its whole value depends on three things: who states it, on what basis, and whether one can check that the document has not been altered since.
The who is the issuer. In Obscura Catalog, the issuer is an agent from the directory, with its capacity: artist, estate, gallery, foundation, expert, museum. A certificate signed by the artist in her lifetime and one issued by a gallery thirty years later do not say the same thing, and the document shows which it is.
The basis is the catalogue raisonné. A work can be certified only if it is Validated or Published, has an accepted attribution in the photographer role, has a catalogue number, and is not confidential. The certificate does not create knowledge: it gives a state of it, at a date.
What the certificate describes
The certificate covers the work (through its reference image) or one or more prints, or even a whole edition. It describes:
- the work: number, title, author, attribution, date, technique, series, rights;
- the certified object: for a print, its number, edition, dimensions, process, signature, condition;
- the source file: name, SHA-256 checksum, pixel dimensions, colour profile;
- the declarations, the provenance, the exhibitions and the publications;
- the legal notice and conservation guidance;
- the signature: algorithm, key fingerprint, key publication address, timestamp if any.
Confidential provenance never appears on it, nor the price, holder or location of a confidential print.
Declarations, and their declarer
Some statements cannot be derived from the catalogue: printed from the original negative, printed under the artist’s supervision, signed by the artist, printed within the announced edition. These are declarations, and someone has to answer for them.
In Obscura Catalog, a declaration always carries the name of its declarer and its date; without a declarer, it is refused. On the certificate, it is not printed as a ticked box but as an attributed sentence: this statement, declared by this person.
It pays to be precise about what that means. The whole certificate, declarations included, is signed by the issuer’s key. The signature therefore proves that the issuer issued this text, which attributes this declaration to this person. It does not by itself prove that the declarer personally signed anything, unless the declarer is also the issuer. The declaration remains the declarer’s own word, reported and signed by the issuer.
What the signature proves
The certificate is an archival PDF (PDF/A-2b) that embeds a signed manifest in Ed25519, a public signature algorithm described in RFC 8032. The manifest holds the certificate’s values; the signature is computed over its exact bytes with the issuer’s private key, stored in the macOS keychain.
The signature proves two things, and only two:
- integrity: the signed content has not changed since it was signed. Change one character of a dimension, a name or a date, and verification fails;
- origin: it was signed by the private key matching a given public key.
Linking that key to a real issuer takes one more piece of information: the public key address. Each issuer publishes its key file at an HTTPS address it controls, and that address is itself signed in the certificate; it cannot be corrected after issuance. If the key published on a known gallery’s website is the one that signed the certificate, you know the certificate comes from whoever controls that site. That is not proof of identity in the legal sense; it is a verifiable link between a document and an address.
What the date is worth
A certificate carries an issue date. But that date is written by the issuer: it is protected against alteration, since it is signed, without being attested by a third party.
To have it attested, there is RFC 3161 timestamping: a timestamp authority issues a token attesting that the signature existed at a given moment. In Obscura Catalog this is optional and set in the certificate settings (RFC 3161 timestamp authority (optional), an https:// address). With no authority, no network call is made and the certificate states that its date is declarative. With one, each certificate receives a token (Timestamped badge in the register); if the authority does not answer, nothing is issued, rather than a weaker certificate that does not say so.
Verifying without taking the issuer’s word for it
A certificate you can only check by asking its issuer is not worth much. Obscura Catalog’s can be verified in two ways, and verifying is free, with no licence.
Online. The certificate prints an address of the form catalog.obscuraflow.app/c/<number>/<version>, and its QR code. It opens the verification page, where you drop the PDF. Verification happens in the browser: the file is sent nowhere. The page checks the checksum of the signed content, the signature and the number, then fetches the public key from the address signed in the certificate; that is its only request. It returns one of five verdicts: valid, invalid signature, unreadable certificate, unknown key, unsupported version.
It also says what it does not know. It does not know the issuer’s register: it cannot tell whether a certificate has been superseded or revoked. A timestamp token is reported, not validated. And “valid” means “signed by the key published at this address”, not “the work is authentic”.
Offline, in the app. Verify a PDF works without a network. The verdict covers the signature, whether the printed page matches the signed manifest, the register (valid, superseded, revoked with date and reason, or status unknown for a certificate issued elsewhere) and the timestamp.
A certificate tied to its reference image
A work’s certificate is tied to its source file through that file’s SHA-256 checksum. If the file changes, even when the image does not, the checksum no longer matches. As the previous article showed, writing metadata into a file without touching its pixels is enough to change its checksum.
Since version 0.10.0, Obscura Catalog protects that link: writing into a certified file asks for confirmation and offers the XMP sidecar instead; the reference image of a certified work can no longer be removed from the library; and a certified work can no longer be deleted.
When the attribution changes
Knowledge of a work evolves. A researcher publishes an argument, another attribution is proposed, the accepted attribution becomes disputed, or even rejected. What happens to certificates issued on the strength of the old one?
In Obscura Catalog they are never revoked automatically, nor left as they are without anyone knowing. As soon as a photographer attribution becomes disputed or rejected, the valid certificates of the work and its prints move to the To review view (for a disputed attribution, this is one of the fixes in version 0.10.0). The guide gives the usual decision: a certificate whose attribution is disputed remains true but imprecise, and is usually re-issued; one whose attribution is rejected has lost its basis, and is usually revoked. Decide… offers Re-issue, Revoke or Keep; keeping requires a reason.
Two rules complete the register. Re-issuing corrects a factual error: the new version keeps the number, the previous one becomes “Superseded”. Revoking is done for a public reason taken from a closed list (issued in error, attribution rejected, forgery detected, object gone, legal withdrawal) and cannot be undone. An issued number is never reused, and an object has only one valid certificate at a time.
What a certificate does not attest
A certificate of authenticity, however well signed, has limits, and stating them is what makes it credible:
- it is not an expert opinion. The software examines neither the paper, nor the pencil signature, nor the process. It formats and signs what the catalogue and the declarers state. The attribution rests on the argument behind it, and authenticating a print remains an expert’s job;
- it does not prove that the object in hand is the one it describes. The certificate describes a print: dimensions, number, signature, inscriptions. Comparing that description with the sheet in front of you is up to the reader;
- it describes a state at a date. An attribution may be disputed later, a certificate superseded or revoked; only the issuer’s register knows, and the online page cannot see it;
- its date is declarative, unless an RFC 3161 timestamp was requested from a third-party authority;
- it is not, by itself, legal proof. The signature proves the document’s origin and integrity. The weight it carries in a sale, a dispute or an estate depends on the applicable law, on the trust placed in the issuer and on the other documents in the file.
A certificate that claimed to prove everything would prove nothing. This one proves little, but it proves it.
End of the series
These four articles followed one thread: a work is not a file, and its number is never taken back; a print is an object, with its edition, its provenance and its gaps; a catalogue must be able to leave its software without losing anything; and a certificate attests a declaration, signed and verifiable, nothing more.
To go further: the page The certificate of authenticity, the Certificates of authenticity chapter of the guide, the release notes and the glossary. Obscura Catalog can be downloaded for macOS; issuing a certificate requires a licence, verifying one is free.
Previous article: LIDO, CIDOC CRM, CSV: moving a catalogue without losing it
To start the series from the beginning: What is a catalogue raisonné, and why does a photographer need one?