How employers check a certificate
What an employer sees on the learner's passport and on the certificate's own page, and how anyone checks the signature without asking you.
3 minute read
The point of issuing on certo is that nobody has to e-mail you to ask whether a certificate is real. An employer, or anyone else, checks it themselves in seconds.
On the learner's passport
The learner decides who reads their passport.
- Anyone who opens a public passport sees the lines on it, your certificate among them, without the details of who confirmed what.
- An employer the learner approves sees the full record: on each line, who confirmed it and what exactly they confirmed. For your certificate, that is your organisation.
The learner can also send the certificate on its own, by its link or its QR code.
The certificate's own page
Every certificate has a permanent address of its own, certo.bio/v/ followed by its id. The address never changes and never expires, so a certificate handed over today still verifies in years to come.
The page answers the reader's question first. For a certificate in good standing it says This certificate is genuine and current, with three checks:
- Signature valid: certo signed it and nothing in it was changed.
- Not revoked: it has not been withdrawn.
- Current to a date, or Does not expire if you gave no expiry.
Under that, the reader sees the certificate, that your organisation confirmed it, and your organisation's registry number.
If something is wrong, the page says so plainly:
| The page says | Meaning |
|---|---|
| Genuine, but the certificate it records expired on a date | The signature still verifies. The expiry you gave has passed. |
| This certificate was revoked | It was withdrawn. The reader should not rely on it. |
| This is not a certificate certo signed | The signature does not verify. Nothing in it can be trusted. |
| No certificate at this address | The address is wrong. |
Is this the person in front of them?
The page has a box for that: Is this the person in front of you? The reader types the name on the document they were handed, for example an ID card, and certo answers yes or no. It never shows a name.
If you gave a date of birth and the learner has since checked their identity, an employer the learner approves also sees whether the name and date of birth match that identity check. See The learner's date of birth.
Checking without certo
A sceptical reader does not have to trust certo's page either. Under Check it yourself, they can:
- Download the signed certificate, a standard SD-JWT file.
- Verify its signature with certo's public keys.
- Look it up in certo's published status list to see whether it was revoked. Fetching the list does not reveal which certificate they are checking.
None of this needs certo's permission, or yours.
What this means for you
You do not need to answer verification e-mails for certificates you issued on certo. The reader checks the signature, sees your name and registry number, and moves on. If a reader does contact you, send them to the certificate's own page.