How a Certalyx certificate is made and checked

The credential statement

A Certalyx certificate records that a named person completed a defined syllabus and passed a scored assessment delivered under controlled conditions. It is evidence of assessed competency in the tasks covered by that syllabus.

It is not a government licence, a university degree, a professional qualification or a guarantee of employment, and it does not authorise the holder to practise any regulated profession.

How a certificate is signed

Each certificate has a payload: the certificate ID, the holder's name, the course identifier, the issue timestamp, the standard code and the learner's country. Those fields, in that fixed order and separated by newlines, form the canonical body.

That body is signed on our servers with an Ed25519 private key. The key exists only in the server environment. A verifier reconstructs the same canonical body from the registry row and checks the signature against the corresponding public key, which we publish at /api/public-key.

The practical consequence: editing a name in the database, or inventing a certificate ID, produces a record whose signature does not verify. The verification page says so plainly rather than showing a green tick.

The registry chain

Every issuance also records a hash over the previous record's hash, the canonical body and the signature. That makes the registry a chain: change a row in the middle and every subsequent link stops matching.

We verify both the signature and the chain on every verification request, not once at issuance. A certificate that verifies today and fails tomorrow is a certificate that was tampered with in between.

Pass marks and item design

The pass mark is 80% on a ten-question paper. Questions are generated from the stated concepts of the course, so every item maps to something the learner was told they would be assessed on. Options are shuffled per attempt to limit answer sharing.

Exam sessions are recorded server-side with a start time, and submissions more than fifteen minutes after the start are rejected regardless of score. Leaving the exam tab counts as a strike; three strikes auto-submits and fails the attempt.

Revocation

A certificate can be revoked for misconduct or for a refunded payment. Revocation is recorded against the registry row and shown on the verification page immediately, because a refunded or withdrawn credential must not keep circulating as evidence.

Revoked records are retained rather than deleted, so that a past verification cannot be rewritten by removing the underlying row.