The first step for creating a certificate is to create a document. A document is a piece of information , it can represent anything. You can have as many documents as you need. In fact a certificate is just a certified document.

Because certificates are publicly accessible to anyone, in most cases you'll want to keep the information on the certificate private.

For instance you may want a certificate for just your date of birth or age without revealing the other information on your drivers licenses, in that case you simply create a document that has only your date of birth or age and have a certificate issued for that, seperate from the more sensitive information (your address for instance) on the rest of your license.

Below is an example of a document.

You should also select the appropriate identity anchor certificate that your new certificate would be linked to. Read the More about certificates user guide section to learn about this field.

Once you have the document, you can make a certificate request. This request will be saved and can be pulled by the person that will be asked to issue the certificate.

When you click the REQUEST CERTIFICATE button above, a new request will be created. You can view all requests associated with a document by looking at the CERTIFICATE REQUESTS tab.

When a new request is created, an id and a key is created for it. You'll need to give this information to the person issuing the certificate so they can get access to your request.

After a certificate is issued for the request, you can download the certificate by clicking the Fetch Certificate archive button noted above.

To issue a certificate, the issuer should obtain the id and key for the request from the person requesting the certificate.

A certificate can be either self-issued or issued by (ie stamped) another certificate. Most certificates will be issued (ie stamped) by another certificate.

For instance a cryptographic drivers license certificate could be issued (ie stamped) by a police officer's certificate and the police officer's own certificate would have been issued by the department's certificate (a self-issued certificate).

As noted above, you can use any of your existing certificates to issue additional certificates.

ID Proofing

If a certificate request is linked to an id certificate, you'll have to request a claim from the identity certificate that includes the actual id information on the certificate. In other words, beyond the basic identity element (driver's license number, passport number..etc), an id certificate should also include basic PII. In order to issue a trustworthy certificate, issuer should review the claim containing the identity element and associated PII before issuing a certificate linked to it.

The goal of this id review is to prevent the requester of the certificate from acquiring a certificate then passing it to someone else to use with a different id certificate. There is no prescribed procedure for reviewing an id certificate since...it is already a certificate and has been verified.

You should really just make sure the information on the id certificate claim makes sense for the context of the new certificate request. For instance if someone in New York is requesting a certificate and gives you an Id certificate claim that shows that the corresponding id certificate was issued to someone with a California driver's license,it may be a cause for further scrutiny. Check for bio-info mismatch, such as the id certificate claims the gender is male but the requester is female, check for things like ethnicity mismatch.

The id claim should be issued for one of your issuer claim receiver ids and you should ensure that it is verified before accepting it. You can create multiple issuer claim receiver ids and rotate between them when challenging for id claims. You should make sure the id claim is current and is generated more or less at the time the certificate is being issued.

Even when someone hands you a fresh and valid claim from an id certificate, it is no proof that they really own the certificate, even when they're standing right in front of you! They could be relaying id information directly from the owner of the id certificate without being in possession of the certificate and its associated private key (aka secret seal), ie the person standing in front of you could simply be a mule, fronting with someone elses id claim. A mule could be controlled via a compromised Certisfy client on their device for instance or the device itself could be compromised.

Basic ID Proofing

One way to combat the potential mule problem is to directly relay the information on the id claim back to the requester (ie a potential mule). The idea is to prevent what we call anonymous peer conspiracy, ie two (or more) people who are anonymous to eachother conspiring to improperly procure and subsequently misuse certificates. By ensuring that at least one party/peer knows id information of the other, you break the anonymity and introduce risk for one or both parties depending on what the issued certificate is subsequently used for.

So when someone hands you a claim from an id certificate in order to procure a new certificate, relay the information back to them to make sure they become aware of it. You could read it back to them, send a receipt via email or text...etc.

Strong ID Proofing

An even more aggressive form of breaking anonymous peer conspiracy is via STRONG id proofing when making a certificate request. For now STRONG id proofing is optional but might become a requirement in the future.

With STRONG id proofing, the person making the certificate request (ie the actual intended recipient of the the issued certificate) is temporarily required to expose (ie stake) their ID certificate (and associated private key) to the risk of exfiltration by any potential mule they may be using to acquire a certificate. The potential mule could even be law enforcement setting up a honeypot trap.

A honeypot trap can also extract Id claims when using Basic ID Proofing with just the identity certificate claim used for proofing. Id claims have identity certificate information so they are almost as bad in terms of identity information exfiltration.

While issuing a certificate, if the requester provides an ID honeypot trap code, just accept it and trap the ID, no questions asked.

To make a claim against facts on a certificate, simply open the certificate and select the fields you wish to make claims against.

You may also add additional fields that have not been verified, and of course the recipient would know that those fields are unverified.

In order for a claim to be trustworthy, it must be tied to an identity anchor certificate. An identity anchor certificate should be the first certificate you acquire in order to use Certify to make trustworthy claims. To learn about what is required for an identity anchor certificate, read the guide section that says More about certificates.

You should also specify the recipient of the claim, they'll give you their unique identifier to use for making claims meant for them. If the claim will be used on a sticker, then the recipient would be the general public so you don't need to specify a receiver, just check the box that says it is for a sticker.

notification_important This section is optional and mainly for advance usecases. If you want to learn some neat tricks then read on, but it is not necessary for using Certisfy.

Stamping documents is another way to use a certificate. Mainly it applies to using your certificate to stamp other documents. In fact the act of issuing a certificate is actually an act of stamping the document the certificate is based on, in order to turn it into a certified document (ie a certificate).

Stamping documents is different from but related to making claims against facts on a certificate. The difference is that the document you stamp isn't verified by another party, any trust placed on the stamped document is based on the trust embodied by the certificate used to apply the stamp and thus based on the trust embodied by the owner of that certificate.

When a certificate is requested (step 1.), the owner of the certificate also gets a secret seal. This secret seal will be used to stamp documents issued by the owner of the issued certificate.

The secret seal is managed by Certisfy so you as the user never use it directly.

Remember, we mentioned earlier that certificates are just documents but they are a bit special from other documents. There are three key things that are special about certified documents (ie certificates).

• As mentioned previously, certified documents have a seal associated with them. The owner of the certificate can use the seal to stamp other documents. This is like being a judge or a doctor, in addition to a certificate you have on a wall that states your qualification, you also get a unique secret seal that you can use to stamp documents.

  For instance you can think of a doctor as having a seal to issue prescriptions. Anyone can read medical documents and even learn how to perform a medical procedure but if you're not a board certified doctor, you in effect don't have the seal needed to stamp prescription documents.

• The second special thing about certificates is that in addition to the information they contain (like your name), they also possess the information needed to verify stamps created with their associated seal.

  If someone gives you a freshly stamped document and showed you their certificate, you'll be able to compare the stamp on the certificate to the new stamp on the document to determine if they were stamped by the same seal. You don't need to see the seal itself you just need to be able to examine the stamped impressions. Certisfy helps you perform this action cryptographically.

• A third special thing about certified documents (ie certificates) is that it is assumed that the information on them has been verified by the certificate issuer. In other words if a police officer issues a cryptographic drivers license certificate to you and you present that certificate to someone, they can assume that the information on it (your drivers license information) was verified before the certificate was issued.

To summarize, certificates and their associated seals are used hand-in-hand by using the seal to generate stamped documents. Whenever you present a certificate to someone, they'll ask you to proove that you're the owner of the certificate by producing a freshly stamped document using the certificate's secret seal.

Remember, certificates are public and anyone can have them and try to use them, the way to prevent misuse is to demand that someone stamps a document using the associated secret seal. If they don't possess the secret seal, they won't be able to generate a valid stamp.

There are a lot of use cases for this ability to stamp documents.

• For instance a journalist could stamp an article (or the link to the article) and publish the stamped article, anyone reading the article could verify the stamp and know that the article is authentic, ie it is not fake news.

• Or let's say a celebrity wants to use their certificate to give you a cryptographic autograph. They'll stamp a document with your name or perhaps an SVG image of themself. The cryptographic stamp would be proof that the autograph is legitimate.

  Having the celebrity stamp the autograph only proves that it is a legitimate autograph but it doesn't prove that it was issued to you. To be able to prove that it was issued to you, you'll first have to stamp the autograph before the given celebrity applies their own stamp over it.

  In the future if you wanted to prove that the autograph was issued to you, you just need to create a newly stamped copy. Certisfy will be able to verify that the original stamp and the freshly stamped copy where stamped by the same secret seal, thus proving that the autograph was truely issued to you.

To stamp a document, simply click the Stamp Document button and select the certificate you want to use to stamp the document.

Remember, a certificate itself is just a document (a slightly special type) that has been stamped by a secret seal. The person/entity whose seal is used to stamp the certificate is called the issuer(ex a police officer).

In the case of a self-issued certificate, Certisfy uses the associated secret seal to stamp it, as opposed to using the seal of some other trusted entity (ie issuer, ex a police officer).

A quick rule of thumb to remember is that not all stamped documents are certificates but all certificates are stamped documents.

There is a simple way to check claims with Certisfy, just pasted them into the verification form or use a sticker code.

A lot of the time claims will not need to be checked by you directly but rather they'll be checked by a service that accepts Certisfy certificates.

• For instance let's say you want to get a blue checkmark next to your name on twitter. Twitter will ask you to make a claim against a certificate that has your name.

  If you give twitter your claim, twitter will be the one who both checks the information on the certificate and verifies the claim using our API.

Beyond knowing how to use certificates, there are some additional facts about certificates that are worth knowing about.

Certificate misuse.

Certificates by themself cannot be considered trustworthy by service providers (ex craigslist). Certificates are handed out to people and there's nothing to stop someone from sharing their certificate and encouraging misuse of it. For instance someone could hand a certificate for an adult to a minor and the service provider would have no way of knowing that the user is a minor.

Even worse, it is possible for criminals to exploit this weakness by selling certificates to people who shouldn't be using them.

Your cryptographic face.

A mechanism for dealing with certificate misuse is via identity anchor certificates. An identity anchor certificate is a certificate that is cryptographically linked to some element of the owner's real identity while still enabling the person to remain fully anonymous.

The owner of an identity anchor certificate will remain fully anonymous, however it would be possible to establish a fixed anonymous cryptographic identity for that person that would be impossible to circumvent. We call this characteristic a cryptographic face.

This is similar to being anonymous IRL but your face can be remembered. For instance if you get thrown out of a bar, they may not know your name or anything else about you but if you show up again, they'll probably remember your face and prevent you from going in.

This ability to remember your cryptographic face even though you're anonymous is a mechanism that can be used to mitigate the risk of misuse. If you misuse a certificate tied to your cryptographic face, service providers can remember that face and likely prevent you from using their service. They don't need to know who you are IRL to be able to enforce this.

Currently the elements of your real identity that can be used to establish a cryptographic face are:

keyboard_arrow_right {{name}} {{desc}}

You'll need to create a document with one of these elements included and have a certificate issued for that document. The document should use the exact labels noted above.

You'll then be able to use that certificate as an identity anchor certificate to derive anonymous cryptographic identities for various services.

Each service will have a unique anonymous identity per identity anchor certificate. So the anonymous identity you have on say twitter would be completely different from the one you have on facebook and the one you have on craigslist.

Certificates and Privacy.

Certificates can be linked to an anonymous identity, services for which you use certificates will generally demand that your certificates be tied to an anonymous identity certificate.

One important measure required to preserve privacy is to never use the same certificate for anonymous and non-anonymous use cases. While you can mask the information on a certificate, the id of the certificate can be used to track the owner activity if the same certificate is used.

For instance, to anonymously verify your age, you should use a certificate that has your age as of the certificate issue date but not your name. Such a certificate can contain other bits of information that you wish to use anonymously, for instance your city/state location.