Certificates of authenticity

A certificate of authenticity attests, signed and dated, the authenticity of a work or a print. It is an archival PDF (PDF/A-2b) carrying an embedded signed manifest. Verification, offline in Obscura Catalog or at the verification address printed on the certificate, checks its signature and that the page agrees with its main values; in the library that issued it, Catalog also compares the file, byte for byte, with the PDF issued (see Verify a PDF).

The Certificats (Certificates) section has three views: Register, To review and Verify a PDF.

Issuing and re-issuing work without a licence, up to 10 certificates (free tier); every paid plan issues without limit. Certificates are counted on this Mac, across all libraries, by number: a new library does not reset the count, a re-issue keeps its number and does not count, a revoked certificate still counts. Verifying a PDF, reading the register, revoking and reviewing stay free (see Licence and free tier). Once the 10 free certificates are issued, Sign and issue stops before any signing and says why.

Before the first issue

Issue… stays greyed out while issuance is blocked. Catalog says what is missing, in the order in which to fix it, and Open certificate settings takes you there (Settings › Certificates):

1. a signing key on this Mac;
2. a backup of that key;
3. an issuer;
4. the public key publication URL: yours, or that of Obscura’s key directory, which hosts the key for you (see The key directory).

Certificate settings

They are in Obscura Catalog › Settings… › Certificates; Settings…, in the Certificats (Certificates) section, takes you there. Save (⌘S) applies the changes, Revert drops them; the key itself is created, backed up and restored on the spot:

• Signing key
  • Create the signing key — the key is kept in the macOS keychain; its Fingerprint is shown;
  • Back up the key… — choose a passphrase of at least 12 characters, confirm it, then save the backup file, encrypted with that passphrase. Keep the file and the passphrase apart: together they can issue in your name. Without a backup, issuance is blocked: losing this Mac would mean no new certificate could be issued under this identity (certificates already issued stay verifiable with the published public key);
  • Export the public key… — saves the public key file (obscura-certificate-key.json), to publish at the address set below. It holds every non-compromised key, current and former, so that old certificates stay verifiable;
  • Restore… — restores a key from a backup (new Mac, lost key), with the passphrase. The restored key is installed in the keychain first; the current key, if any, is only retired afterwards, and the certificates it signed stay verifiable. If the keychain refuses the installation, the current key stays in place, usable;
  • Key directory — Register the key in the directory… publishes the public key at an Obscura address, with no file to host (see The key directory); once the key is registered, the date, the Public address and the Declared name show;
  • Unreadable keychain — if the keychain cannot be read (locked, or access refused to Obscura Catalog), the Signing key section says so in red, with Try again, and issuing is blocked: this is not “no key”. Nothing is changed while the key stays unreadable: Catalog does not create a new key over it, and refuses to restore a backup, because the current key could not be retired and its certificates would no longer be recognised. Unlock the keychain or allow access, then Try again.
• Issuer — an agent of the directory (create it first in Agents), and its Capacity: artist, estate, gallery, foundation, expert, museum.
• Number prefix — with an example. A certificate number has the form <prefix>-CERT-<year>-<sequence>, for example SB-CERT-2026-00042; it is independent of the work’s catalogue number.
• Addresses
  • Public key URL (https://…) — required: where you publish the public key file, or the key directory’s address, which registering the key writes there. It is signed into every certificate and cannot be corrected after issuance;
  • Verification address (optional) — empty, it is catalog.obscuraflow.app/c, Obscura Catalog’s permanent address;
  • RFC 3161 timestamp authority (optional) — empty by default: issuance then makes no network call, and the certificate states that its date is self-declared. Only an https:// address can be used.
• Notices — Legal notice and Conservation guidance, printed on the certificate. Variables: {{artist}}, {{year}}, {{issuer}}. The text is signed in the language you write it in.

Save keeps them.

Another library on the same Mac

Certificate settings belong to the library (certificate-settings.json, next to Catalog.sqlite): they follow it in its backups and to another Mac. This Mac also remembers, in the app’s preferences, your last saved settings and the confirmed key backups. A new library therefore does not have to be set up again:

• Key backup — the signing key is the one in this Mac’s keychain, the same for all your libraries. A confirmed backup counts for that key (its fingerprint) in every library of the Mac: the new library takes it over, with its date. Another key takes over nothing, and a key declared compromised in one library is taken over nowhere: it no longer signs in any, verification no longer recognises it in any, and none publishes it in its public key file any more.
• Taken from your last settings — a library with no certificate settings yet starts from your last ones: public key URL, verification address, timestamp authority, notices, issuer capacity and name. The “Issuance is blocked” banner then offers Use your last settings…. Nothing is written into the library before Save.
• The issuer is proposed, never imposed — the agent of the new library bearing exactly the same name (case, accents and punctuation aside, never a close name) is preselected: Confirm the issuer, or choose another. If several agents bear that name, choose it in the list. If none does, Create as a person or Create as an organisation creates it in Agents, or choose another agent.
• A number prefix of its own for each library — two libraries of the same issuer numbering the same way would produce two certificates with the same number. The prefix taken over is therefore replaced by a proposal (SB becomes SB2): Use this prefix, or type another one. A prefix already saved on this Mac or in the source library is refused.
• Use another library’s settings… (at the bottom of Settings › Certificates) — choose another library’s folder (the one holding Catalog.sqlite): its certificate settings are taken over, with the same rules for the issuer and the prefix. A folder without settings or a damaged file is refused, and nothing is taken.

A library whose settings name an issuer missing from its directory (a certificate-settings.json file copied by hand) is blocked on the issuer; the banner offers Confirm the issuer….

The key directory

Obscura’s key directory (not to be confused with the directory of agents) publishes your public key for you, at an address the verification page reads, https://keys.obscuraflow.app/catalog/iss_….json: you no longer have a file to host. It attests that a key was registered by the holder of an Obscura account, on a date, by a request signed with that key. It does not attest your identity: the name shown is the one you declare, and the verification page says so in those terms.

• Register the key in the directory… (Settings › Certificates › Key directory) needs a signing key that is not compromised and a session open in Account & Licence, with an active licence: the request, signed by the key (which never leaves the Mac), carries your licence. The sheet says what will become public: the public key and its fingerprint, the registration date (and the revocation date, if the key is ever revoked), and the declared name, that of the issuer in these settings, or none. Register the key sends it; an e-mail goes to the account holder.
• The status then shows: “Registered in the directory on …”, the Public address and the Declared name. It is kept in the library’s certificate settings.
• The publication address: if Public key URL is empty, it takes the directory’s address, and issuing is no longer blocked by the address. If an address is already there, Catalog asks: Use the directory’s address or Keep the current address (then keep the public key file up to date at your address). New certificates sign the address kept; certificates already issued do not change, their address is signed. Settings carried over from another library and not saved yet are only changed in the form: Save keeps them.
• The issuer’s name changes: Catalog says so (“The issuer’s name is …; the directory shows …”) and offers Update the name…, after confirmation; nothing is sent without your consent. An issuer with no name removes the name shown; the keys, their dates and their status stay published.
• When the directory does not answer (connection down, service temporarily unavailable), Save the request… writes the signed request to a file, to deposit on the profile site (profil.obscuraflow.app, Certificate keys page, Deposit a request…). The request carries a single-use code issued by the directory, valid 10 minutes: it is prepared while the directory answers, and deposited within 10 minutes. With no connection at all, it cannot be prepared, and Catalog says so.
• A refusal is worded plainly: key already registered by another account, licence inactive or for another product, the Mac’s clock more than 10 minutes off, too many requests in a short time, name refused (1 to 200 characters, no line break).

Only these actions reach the directory: neither issuing nor verifying a certificate in the app calls it.

Online verification

Each certificate prints the address catalog.obscuraflow.app/c/<number>/<version> (and its QR code). It opens a page of the website where you drop the certificate’s PDF: the check runs in the browser, the PDF is not sent anywhere. The page checks the fingerprint of the signed content, the signature and the number, then looks for the public key at the public key address signed into the certificate and, by the key’s fingerprint, in Obscura’s key directory: two reads at most (one when the signed address is already the directory’s), which send only the fingerprint, which is public. Separately, as on every page of the site, Cloudflare’s visitor analytics (Cloudflare Web Analytics, no cookies) may load and send Cloudflare the page address, hence the certificate number, and load timings; never the PDF or the result. It does not run for visitors served by a Cloudflare data centre in the European Union. The page gives one of five verdicts: valid, invalid signature, unreadable certificate, unknown key, unsupported version.

For the verdict to be valid, the key must be published: registered in the key directory, or online at the signed address, served over HTTPS with the Access-Control-Allow-Origin: * header; otherwise the page answers “unknown key”. A key revoked in the directory is never declared valid, even for a certificate dated before its revocation. The page does not know the issuer’s register: it does not tell whether a certificate has been revoked. Only the app does (see Verify a PDF).

Issue a certificate

1. Issue… opens “Issue a certificate of authenticity”.
2. Search for the work (number, title) and choose it. A work that cannot be certified says so under its title.
3. Under Certified object, choose:
   • The work number (reference file) — the certificate covers the work through its reference image;
   • and/or one or more Prints; Whole edition ticks every print that does not yet have a valid certificate.
4. If needed, tick Declarations — printed from the original negative, printed under the artist’s supervision, signed by the artist, printed within the stated edition — and give the Declarer (name). A declaration is a statement signed by a named person: without a declarer, it is refused.
5. Issue (or Issue n certificates), then Sign and issue.

Each certificate is signed, numbered and recorded in the register. An issued number is never reused. Several certificates issued together are issued all or nothing: if one fails, none is issued and no file remains.

The PDFs are kept in the library’s Certificats folder, named <number>-v<version>.pdf. If a PDF cannot be put there once the certificate is in the register (disk full, permissions), the certificate is issued all the same: a warning says so, with Try again, and the PDF, already verified, waits in the folder; Catalog also tries again each time the section opens.

What can be certified

A work can be certified if:

• it is Validated or Published;
• it has an accepted attribution in the photographer role;
• it has a catalogue number;
• it is not confidential, and its photographer is not a confidential agent.

An object has only one valid certificate at a time: to correct it, re-issue it rather than issuing a second one.

What the certificate contains

The certificate describes the work (number, title, author, attribution, date, technique, series, rights…), the certified object (for a print: number, edition, dimensions, process, printer, signature and its text as written on the print, condition…), the source file (name, SHA-256 fingerprint, pixel dimensions, colour profile), the declarations, the provenance, the exhibitions and the publications, the genealogy (the work’s files in their physical order, from negative to print, then the edition’s prints and the reproductions), the notices, the signature (Ed25519 algorithm, key fingerprint, key publication address, timestamp) and a QR code leading to the verification address.

Confidential provenance and confidential agents never appear in it (a confidential printer, party or venue is absent, as if not given). No amount is printed on it, nor a print’s current holder, location or price, nor an internal note.

The work’s rights appear in it, on a work’s certificate as on a print’s: the rights statement, then each rights line of the work, in its order, with the rights holder, the licence and the licence terms. Neither the expiry, nor the reproduction restrictions, nor the internal note go in. A confidential rights holder is not named: only their licence appears.

The process, the printer and the signature text belong to the print: a work’s certificate does not carry them. Relations between works, auction sales, conservation interventions, documents and storage locations never go into the certificate.

Manifest versions

The signed content of a certificate is its manifest, whose format carries a version number. Since version 0.19.0, Catalog issues version 2 certificates, which add the signature text and the rights lines to the manifest. Certificates issued before keep their version 1 and remain valid as they are: Catalog verifies both versions, forever. A version 1 certificate that is re-issued becomes a version 2 certificate.

The layout has its version too, printed in the footer (catalog-cert-v3, for instance). Since version 0.19.1, the sentence under the verification address says what verification checks: the signature and that the page agrees with the manifest’s main values, the issuer’s register alone attesting that the file is the one issued. Certificates already issued keep their layout and their sentence; the manifest’s format does not change.

Timestamping

If a timestamp authority is set, each certificate receives an RFC 3161 token attesting that its signature existed at that date (Timestamped badge in the register). If the authority does not answer, nothing is issued: try again, or clear the authority’s address to issue without a timestamp (the date is then declarative).

The register

The Register lists every certificate issued from this library, newest first, with its status: Valid, Superseded or Revoked. Search by number or work and the Status filter narrow the list.

Right-click a certificate: Open the PDF, Show in Finder, Verify this PDF and, for a valid certificate, Re-issue… and Revoke….

Re-issue

A clerical error (a typo, a dimension) is corrected by re-issuing: the new version keeps the number, takes the catalogue’s current state and its declarations; the previous version becomes “Superseded”. Confirm with Issue version n. If the certificate was revoked or superseded in the meantime, the re-issue is refused and nothing is issued: never a new number behind your back.

Revoke

Revoke… asks for a reason, public, taken from a closed list — issued in error, attribution rejected, forgery detected, object gone, legal withdrawal — and an optional detail. The certificate stays in the register, but every verification will say it is revoked. This cannot be undone. A typing or editing mistake does not justify a revocation: re-issue.

Compromised key

Compromised key…, in Settings › Certificates › Signing key, is only for a signing key that has leaked. For the chosen key, Catalog shows how many valid certificates it signed. Revoke… then confirm (“Revoke 3 certificates”): the key is first marked compromised (no more issuing, removed from the public key file), then every valid certificate it signed is revoked for “Signing key compromised”. Those already revoked keep their reason. Then create or restore another key.

If the key was registered in the key directory from this library and it is this Mac’s key, its revocation is also sent to the directory: the verification page will no longer declare valid any certificate it signed. If the directory does not answer, Catalog says the revocation remains to be done there, with Revoke the key in the directory… (and, if needed, Save the request…). A key no longer in this Mac’s keychain cannot sign its revocation: revoke it on the profile site, Certificate keys page.

To review

The To review view gathers the certificates whose basis has changed: when their work’s attribution becomes disputed (the certificate stays true but imprecise: it is usually re-issued) or rejected (it no longer has a basis: it is usually revoked). Nothing is ever revoked automatically.

Decide… opens the decision: Re-issue, Revoke or Keep (the certificate stays as printed; a reason is then required), with a note. Reopen puts a decision back on hold.

Certificates arrive there on their own: as soon as a photographer attribution becomes disputed or rejected (the record’s Attributions tab, or batch attribution), the valid certificates of the work and of its prints move to To review.

Verify a PDF

Verify a PDF: choose (Choose a PDF…) or drop a PDF. Verification runs offline, on this Mac, and answers:

• on the signature: Valid signature, Invalid signature: the document was altered, Intact signature, unknown key (the key is unknown to this installation), Unreadable manifest, Unsupported manifest version, or This PDF carries no certificate;
• on the page: it matches, or does not match, the signed manifest;
• on the register: valid, superseded by a newer version, revoked (date and reason), or status unknown offline for a certificate issued elsewhere. The register only speaks for the document it issued: if the signature does not verify, it is not consulted (“Register not consulted”); if the number names another document there (another manifest, another key), verification says so, and nothing is added to that certificate’s verification log;
• on the file, for a certificate of this library: it is the one issued, byte for byte, or it was changed after it was issued (an update appended to the PDF, a page redone) — then it is not the document issued, even if its signed manifest is intact;
• on the timestamp: absent (self-declared date), valid, from an authority not recognised by this Mac, invalid or unreadable.

It also shows the number, the issuer, the issue date, the object, the key’s short fingerprint and the verification address, then the certified object as signed: for a print, the edition, the copy and the dimensions; for a work, the dimensions. Compare them with those printed on the page.

The “In the app, offline” link

Each certificate also prints an obscura-catalog:cert/<number>/<version> link. Clicked (or typed in a browser) on a Mac where Obscura Catalog is installed, it opens Certificates › Verify a PDF on that number: what the open library’s register says of it (valid, superseded, revoked, or not in this register), the object and the issue date. A number alone proves nothing: then choose the certificate’s PDF to verify its signature and its page.