Verification

Verify a certificate of authenticity

An Obscura Catalog certificate of authenticity attests the authenticity of a work or a print, and carries its issuer's signature. This page checks that the document has not changed since it was signed, and which key signed it.

Your file stays on your device

Your browser reads the PDF in memory. It is not sent anywhere. The check runs in your browser. It reads the key file the issuer publishes, at the address given in the certificate, and the one in the Obscura key directory (keys.obscuraflow.app), which provides the key if that address does not and says whether it has been revoked; it sends the directory only the key fingerprint, which is public. These are its only two network requests. Separately, as on every page of the website, Cloudflare's audience measurement (Cloudflare Web Analytics, no cookies) may load its script and send Cloudflare the page address, and so the certificate number it carries, along with load times; never the PDF or the result of the check. It does not run for visitors served by a Cloudflare data center in the European Union.

Certificate named by this address

No number in the address: the page checks the certificate you drop, without comparing it to a printed address.

Drop the certificate (PDF) hereor click to choose the file

Issuer's key file (optional)

If neither the address given in the certificate nor the Obscura key directory provides the key, you can paste a key file here (obscura-certificate-key.json) to check that the signature is mathematically intact. A pasted key is not authenticated by the issuer: the result then stays “Unknown key”, never “Valid”.

Key file content (JSON)

The five possible results

ValidThe signature is correct and the key is published by the issuer, or registered in the Obscura key directory.
Invalid signatureThe document was changed after it was signed, or was not signed by the announced key.
Unreadable certificateThe file does not carry a usable certificate, or its signed data does not match its digests.
Unknown keyThe certificate's key could not be obtained from the issuer or from the Obscura key directory, or the issuer has revoked it: the signature cannot be attributed.
Unsupported versionThe certificate declares a manifest version this page cannot interpret.

What the page checks

The certificate's Ed25519 signature (RFC 8032), computed over the exact bytes of the signed manifest carried in the PDF.
The SHA-256 digest of those bytes, which must match the one the certificate declares.
The key: it must be listed in the key file the issuer publishes, at the address written in the certificate's signed data, or failing that in the Obscura key directory, and its SHA-256 fingerprint must match the one the certificate announces. Only a key published that way can give “Valid”.
Key revocation: a key the issuer has revoked (in its key file or in the Obscura key directory) never gives “Valid”, even for a certificate dated before the revocation (a compromised key can backdate).
The number and version: those in the address must be the ones the signature covers.
For an archive certificate, the annex (the file list delivered next to the PDF): if you drop it, its SHA-256 fingerprint must be the one the certificate signs.

What it does not check

Register status (valid, superseded, revoked): no public register can be queried yet. It is shown as “unknown outside the register”, never “valid”.
The timestamp: the page says whether the certificate carries an RFC 3161 timestamp token, without validating it.
The issuer's identity: “valid” means “signed by the key published at this address”, or “by a key registered in the Obscura directory by the account that declares this name”. Oorun does not verify the issuer's identity: make sure the address, or the name, is the issuer's.
Whether the printed text matches the signed manifest: only the values shown here, read from the signed bytes, are guaranteed.

The certificate of authenticity →

Verify a certificate of authenticity

Certificate named by this address

Result

Signed values

Annex: file list