How do I know an Exposentry report is genuine and unaltered?

Every report is digitally sealed (PAdES) and carries an independent timestamp. Open the PDF in Adobe Reader: a valid seal shows the document has not changed since signing. Compare the fingerprint of our certificate with the value on this page.

Why does Adobe Reader show 'validity unknown'?

We currently use our own organisation seal (self-signed). It is tamper-evident, but is not yet in Adobe's default trust list. Add our certificate once as a trusted identity, or compare the fingerprint, to confirm the seal.

Does my report leave your environment when it is signed?

No. The report is sealed on our own systems. For the timestamp only a hash is exchanged with a timestamping service, not the report itself.

Back to knowledge base

Verifying an Exposentry report: digital seal and timestamp

Q: What is the fingerprint of the Exposentry signing certificate?

The SHA-256 fingerprint is 51:7A:AE:9E:1E:02:E8:D3:A4:E5:62:69:00:A4:34:0A:27:9F:94:7B:5B:B8:C0:85:47:24:34:B7:BF:0C:BB:B1. Always check this against the certificate you download.

Published on June 26, 2026

Every report Exposentry delivers is digitally sealed and carries an independent timestamp. That lets you prove two things: that the report is genuinely ours, and that it has not been altered since it was created. This is exactly what an auditor, cyber insurer or large customer wants to be able to check.

What the seal does

Integrity: the seal covers the whole document. Change a single byte and the seal becomes invalid. Adobe Reader shows this immediately.
Timestamp: the report carries an independent timestamp (RFC 3161). It proves the document existed in this exact form at that moment.
Origin: the seal is made with the signing certificate of Hasecon (the publisher of Exposentry).

Our public certificate

You can verify the seal yourself using our public certificate. The private key never leaves our systems; only the public part is below.

Download: exposentry-report-signing.pem
Issuer: O = Hasecon, CN = Exposentry (Hasecon), C = NL
Valid: 26 June 2026 to 25 June 2031
SHA-256 fingerprint:

51:7A:AE:9E:1E:02:E8:D3:A4:E5:62:69:00:A4:34:0A:27:9F:94:7B:5B:B8:C0:85:47:24:34:B7:BF:0C:BB:B1

After downloading, always confirm the fingerprint matches the value above:

openssl x509 -in exposentry-report-signing.pem -noout -fingerprint -sha256

Checking the report

In Adobe Reader

Open the PDF. A banner about the signature appears at the top.
Click the signature panel. A valid seal reports that the document has not changed since signing.
To have the origin trusted automatically too, add our certificate once as a trusted identity (Edit, Preferences, Signatures, Identities and Trusted Certificates).

From the command line

With pyHanko you can check the seal and the timestamp:

pyhanko sign validate --trust exposentry-report-signing.pem report.pdf

An honest note

We currently use our own organisation seal. It provides full tamper-evidence and a timestamp, but Adobe does not yet show a green check automatically because the certificate is not in the default trust list. That is why we publish the certificate and fingerprint here, so verification is possible today. We are working towards a qualified EU seal, which will make confirmation fully automatic.

Written by Edward Hasekamp, founder of Exposentry and core maintainer of the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides NL-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.