Verifying an Exposentry report: digital seal and timestamp
Published on June 26, 2026
By default, every report Exposentry delivers is digitally sealed and carries an independent timestamp. That lets you prove two things: that the report is genuinely ours, and that it has not been altered since it was created. This is exactly what an auditor, cyber insurer or large customer wants to be able to check.
Sealing is a non-fatal step in our process: if, in rare cases, a seal cannot be applied, we still deliver the report, but without a seal. Such a report is perfectly valid in substance; it simply lacks the means to check origin and integrity this way. The absence of a seal is therefore not a contradiction of "sealed by default", but it does mean you cannot run that particular check.
What the seal does
- Integrity: the seal covers the whole document. Change a single byte and the seal becomes invalid. Adobe Reader shows this immediately.
- Timestamp: the report carries an independent timestamp (RFC 3161). It shows the document existed in this exact form at that moment and makes it implausible that the date was shifted afterwards, which makes back-dating a report considerably harder.
- Origin: the seal is made with the signing certificate of Hasecon (the publisher of Exposentry). A valid seal whose fingerprint matches the value on this page means the report is genuinely ours and was not forged by a third party.
Our public certificate
You can verify the seal yourself using our public certificate. The private key never leaves our systems; only the public part is below.
- Download: exposentry-report-signing.pem
- Issuer:
O = Hasecon, CN = Exposentry (Hasecon), C = NL - Valid: 26 June 2026 to 25 June 2031
- SHA-256 fingerprint:
51:7A:AE:9E:1E:02:E8:D3:A4:E5:62:69:00:A4:34:0A:27:9F:94:7B:5B:B8:C0:85:47:24:34:B7:BF:0C:BB:B1
After downloading, always confirm the fingerprint matches the value above:
openssl x509 -in exposentry-report-signing.pem -noout -fingerprint -sha256
Checking the report
In Adobe Reader
- Open the PDF. A banner about the signature appears at the top.
- Click the signature panel. A valid seal reports that the document has not changed since signing.
- To have the origin trusted automatically too, add our certificate once as a trusted identity (Edit, Preferences, Signatures, Identities and Trusted Certificates).
From the command line
With pyHanko you can check the seal and the timestamp:
pyhanko sign validate --trust exposentry-report-signing.pem report.pdf
If verification fails
If a check does not pass, treat it as a signal not to trust the report at face value. Think of a seal that is invalid or broken, a fingerprint that does not match the value on this page, or a report that carries no seal at all where you expected one. In those cases, do not rely on the contents; contact us at scan@exposentry.io or the address in our security.txt so we can confirm whether the report is genuinely ours and which version is the correct one.
An honest note
We currently use our own organisation seal. It provides full tamper-evidence and a timestamp, but Adobe does not yet show a green check automatically because the certificate is not in the default trust list. The timestamping service we use by default (FreeTSA) is likewise a reliable RFC 3161 service, but not itself a qualified eIDAS timestamping service yet. That is why we publish the certificate and fingerprint here, so verification is possible today. We are working towards a qualified EU seal, which will make confirmation fully automatic.
The seal is our own layer on top of the scan itself: Exposentry runs on OpenKAT, the open-source scanning platform to which Edward Hasekamp (Hasecon) contributes, and we add the PAdES seal and timestamp on top of it as Exposentry.
Written by Edward Hasekamp, founder of Exposentry and collaborator on the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides EU-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.