In this lesson you
- Found a certificate's ID and opened its public page
- Checked a file against its certificate's fingerprint
- Recognised a withdrawn certificate and corrected a mistyped ID
Transcript
Every certificate has an ID
A certificate anyone can verify. Suppose someone sends you a PDF and tells you it's certified accessible. How would you know the certificate is real? You check it yourself, using its ID. Every certificate Proof issues carries one, printed on the certificate. Inside Proof, the Evidence Register lists each document's certificate by that ID. One row here is marked Withdrawn, because its document was deleted. We'll come back to it. Anyone who has the ID can open the certificate's public page. They don't need an account, or any connection to your organization. Let's open the certificate for Patient Rights and Responsibilities.
What the page tells you
The top of the page answers the first question. This certificate was issued by Ockem Proof. The line under it gives the date it was issued, and below, Certificate details names the document it covers. Next, the claim itself. Under the heading is the verdict at issuance, WCAG 2.1 AA Compliant, with the counts of checks behind it. Three columns then say who stands behind each part. What Ockem Proof tested, what the organization confirmed, and what the certificate doesn't claim. Reading those columns has its own lesson, What 'certified' means. This page proves the certificate is genuine. It is not itself an accessibility audit. Before you rely on a certificate, ask one more question. Is it still the current one? The line under the columns answers it. Here, this is the most recent certificate on record for this document. If the document had been changed and certified again, this line would point you to the newer certificate.
Is it the same file?
A genuine certificate only helps if it belongs to the file in your hands. That's what the fingerprint is for. Under Certificate details, PDF SHA-256 is a fingerprint of the exact file Proof certified. Change a single byte of the file, and its fingerprint changes. To check, compute the SHA-256 fingerprint of the file you were sent. The note below shows a command for it. If the two match, you hold byte for byte the file Proof certified. If they don't, the file changed after it was certified, and this certificate doesn't cover it. Below that, Checking engine records which version of Proof's checks reached this verdict. A verdict can always be traced to the engine that made it.
When a certificate no longer stands
Certificates can stop standing. Here's how you'd know. This is the withdrawn certificate from the register. Its page says at the top that the certificate has been withdrawn, and on which date. Under Why you are seeing this, it gives the reason. Here, the document it described was deleted. It still records a real assessment, made on the day it was issued. But it is no longer a current claim, so treat any copy of it as history. A certificate can also be re-issued under a new ID. Its page then says so, and links to the certificate that replaced it.
A mistyped ID
And what if an ID matches nothing? Usually it's a typing slip. The page says no certificate matches this ID. It explains that an ID uses only the digits zero to nine and the letters A to F, so a letter O is really a zero. It also keeps what you typed, so you only fix the one character. Correct it, choose Check again, and the certificate's page opens. If an ID matches the certificate exactly and still isn't found, Ockem has no record of issuing it. The page gives an address to report it. Now you can confirm a certificate is genuine, check that it covers the file you hold, and tell when it no longer stands.
Recap
That's the end of this lesson.
Maple Ridge Community Health, its documents and its people are fictional, made for these lessons.