OSINT Certificates
Signed, verifiable certificates for OSINT courses, CTFs, conferences, and communities. What a certificate is, who issues one, and how anyone checks it.
OSINT Certificates is the credential issuer built into OSINTverse. A team sets up an issuer, defines a credential type, and issues certificates from a form, a CSV, or the REST API. Each certificate is a signed record with a public verification page; recipients claim it and decide whether the page shows their name, their handle, or both.
What a certificate is
Every certificate is three things, in this order of importance:
- A signed record. A canonical JSON document naming the issuer, the credential type, the recipient (as salted commitments, not plain text), the issue and expiry dates, per-recipient fields, skill tags, and an evidence link. It is hashed with SHA-256 and signed with Ed25519 at issue time and never edited afterwards.
- A public id.
OVC-XXXX-XXXX-XXXXby default, or an issuer-chosen prefix and eight digits such asOSINTCOL1-48213967when the credential type sets one. Printable and unguessable, on the PDF, the PNG, the email, and the page. - A page.
/certificates/verify/{id}shows the live status (valid, revoked, expired, superseded), the issuer and its trust level, what was awarded, downloads, and a verify-it-yourself block. The same content is at/certificates/verify/{id}.jsonand.md, or by sendingAccept: text/markdown.
Status lives outside the signature. A revoked certificate keeps its record and its page and says it was revoked, with the date and the issuer's reason when the issuer made it public. A corrected certificate is reissued as a new record; the old one is marked superseded and links forward.
Who does what
| Actor | What they do |
|---|---|
| Issuer | A team workspace with an issuer profile. Owners and admins manage the profile, logo, types, and verification; owners, admins, members, and analysts issue, resend, reissue, and revoke. |
| Recipient | An email address. Claiming attaches the certificate to an OSINTverse account and unlocks the privacy controls on Dashboard → Certificates. An unclaimed certificate is still verifiable. |
| Verifier | Anyone, with no account: a hiring manager, a conference, a browser agent, or an MCP client using verify_credential. |
| OSINTverse | Signs records, publishes the keys, reviews issuer verification requests, and can suspend an issuer or revoke a certificate on abuse. |
Trust levels
An issuer starts unverified: it can issue from day one, one certificate at a time, under a small monthly cap, and every page says the issuer is not verified by OSINTverse. Requesting verification means giving a proof that you control the issuer's domain (a page, a DNS record, or an email on the domain); a person reviews it. A verified issuer gets CSV and API batches, a higher cap, and the Verified mark. A suspended issuer cannot issue or email, and its existing certificates keep their real status.
| Issuer trust | Certificates a month | Recipients per batch |
|---|---|---|
| Not verified | 25 | 1 (single send only) |
| Verification in review | 25 | 1 (single send only) |
| Verified issuer | 2000 | 500 |
| Verification declined | 25 | 1 (single send only) |
| Suspended | cannot issue | cannot issue |
| Limit | Value |
|---|---|
| Active credential types per issuer | 50 |
| Per-recipient fields per type | 6 |
| Skill tags per type | 8 |
| Signatories per type | 2 |
| CSV file size | 1 MB |
| Recipient name | 120 characters |
| Recipient handle | 60 characters |
| Personal message | 300 characters |
| Issuer logo | 2 MB, PNG or JPEG |
| Public verification reads | 60 per minute per IP |
| Claim attempts | 10 per minute per IP |
| Issued-certificates list page | 100 rows |
| Certificates listed on a profile | 50 |
Pages in this section
- How verification works: the canonical record, the hash, the Ed25519 signature, the salted recipient commitments, the keys endpoint, and a worked example with
curlandopenssl. - Issuing: credential types, layouts, CSV columns, caps, the claim flow, and what resend, reissue, and revoke do.
- API: the public verify endpoint, the REST issuing API for
ov_team keys, and the MCP tool. - Privacy: display modes, unlisted pages, the public profile, and what account deletion does.
Public records
- Transparency log: every certificate issued through OSINTverse, in issue order, as a hash chain with a signed head (
/api/certificates/logand/api/certificates/log/head). Ids, issuers, hashes, and status only, never recipients. - Public keys: every Ed25519 key that ever signed a certificate.
- Verified issuers: the directory of issuers OSINTverse reviewed, each with its credential types and certificate count. Never recipients.
Marketing overview: osintverse.com/certificates.