Back to knowledge base

Verifying an Exposentry report: digital seal and timestamp

Published on June 26, 2026

A report is only evidence once someone else can establish that it is correct. That is why, by default, we digitally seal every report Exposentry delivers and add an independent timestamp, at the moment it is drawn up. With that seal you can prove two things: that the report is genuinely ours, and that not a single letter has changed since it was drawn up. This is exactly what an auditor, cyber insurer or large customer wants to be able to check without having to take anyone's word for it. And you can do it in two ways: manually, with our public certificate and the fingerprint, or automatically through our API. This page explains how both work and what each check proves exactly.

Sealing is a non-fatal step in our process: if, in rare cases, a seal cannot be applied, we still deliver the report, but without a seal. Such a report is perfectly valid in substance; it simply lacks the means to check origin and integrity this way. The absence of a seal is therefore not a contradiction of "sealed by default", but it does mean you cannot run that particular check.

What the seal does

Technically, the seal consists of two parts: a PAdES signature (applied with pyHanko) and an independent RFC 3161 timestamp (FreeTSA by default). Together they make the report tamper-evident: any change is visible afterwards. This is what each part proves:

• Integrity: the seal covers the whole document. Change a single byte and the seal becomes invalid. Adobe Reader shows this immediately. You can therefore be certain that the figures, findings and conclusions you read are exactly the same as when the report was sealed.
• Timestamp: the report carries an independent timestamp (RFC 3161). It shows the document existed in this form at that moment and makes it plausible that the date was not shifted afterwards. That makes back-dating a report, or pretending a finding was there earlier or later, considerably harder.
• Origin: the seal is made with the signing certificate of Hasecon (the publisher of Exposentry). A valid seal whose fingerprint matches the value on this page means the report is genuinely ours and was not forged by a third party.

With each report we also record when and where the seal was applied: the fields signed_at and signature_tsa in our report overview (available through the API) show the time of signing and the timestamping service used.

Our public certificate

You can verify the seal yourself using our public certificate. The private key never leaves our systems; only the public part is below, and with it you can verify without being able to forge anything.

• Download: exposentry-report-signing.pem
• Issuer: O = Hasecon, CN = Exposentry (Hasecon), C = NL
• Valid: 26 June 2026 to 25 June 2031
• SHA-256 fingerprint:

51:7A:AE:9E:1E:02:E8:D3:A4:E5:62:69:00:A4:34:0A:27:9F:94:7B:5B:B8:C0:85:47:24:34:B7:BF:0C:BB:B1

After downloading, always confirm the fingerprint matches the value above. The fingerprint is a unique identifier of the certificate: if it matches, you know you have the genuine Exposentry certificate and not one that merely carries the same name.

openssl x509 -in exposentry-report-signing.pem -noout -fingerprint -sha256

Checking the report

You can verify in two ways: visually and manually (in Adobe Reader or from the command line), or automatically through our API.

Check in Adobe Reader

1. Open the PDF. A banner about the signature appears at the top.
2. Click the signature panel. A valid seal reports that the document has not changed since signing.
3. To have the origin trusted automatically too, add our certificate once as a trusted identity (Edit, Preferences, Signatures, Identities and Trusted Certificates).

Check from the command line

With pyHanko you can check the seal and the timestamp in one command. With --trust you supply your own copy of our certificate, so you do not have to rely on whatever happens to be in the PDF:

pyhanko sign validate --trust exposentry-report-signing.pem report.pdf

Check through the API

If you want to build verification into your own process, you can automate it. The endpoint GET /api/v1/reports/{id}/verify confirms whether the seal of a report is valid. You can use it, for example, to establish programmatically on receipt of each report that it is unaltered, without manual steps.

Note: this endpoint requires you to be logged in and works only for your own reports (it is scoped to your own account, so you can only check reports that belong to you). An external auditor or customer without an account therefore does not use the API, but verifies the report through Adobe Reader or pyHanko and the fingerprint above.

If verification fails

If a check does not pass, treat it as a signal not to trust the report at face value. Think of a seal that is invalid or broken, a fingerprint that does not match the value on this page, or a report that carries no seal at all where you expected one. In those cases, do not rely on the contents; contact us at scan@exposentry.io or the address in our security.txt so we can confirm whether the report is genuinely ours and which version is the correct one.

An honest note

We are open about what this seal currently is and is not. We now use our own organisation certificate (self-signed). It provides full tamper-evidence and an independent timestamp, but it is not yet a qualified eIDAS seal. Adobe therefore does not yet show a green check automatically, because the certificate is not yet in the default trust list. That does not change the evidential value of the integrity and the timestamp: they do not depend on that trust list. It only means that you confirm the origin yourself, by adding the certificate once or comparing the fingerprint. The timestamping service we use by default (FreeTSA) is likewise a reliable RFC 3161 service, but not itself a qualified eIDAS timestamping service yet. That is why we publish the certificate and fingerprint here, so verification is fully possible today. We are working towards a qualified EU seal (eIDAS), which can take its place later and will make confirmation of origin fully automatic.

The seal is, incidentally, our own layer on top of the scan itself: Exposentry runs on OpenKAT, the open-source scanning platform to which Edward Hasekamp (Hasecon) contributes, and we add the PAdES seal and timestamp on top of it as Exposentry.

To learn more, see the other explanations in our knowledge base.

Written by Edward Hasekamp, founder of Exposentry and collaborator on the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides EU-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.