Certificates

One certificate covers one wiped drive. A wipe becomes eligible when it is completed, which means the erase ran and its check passed (see Data wiping). A failed or stopped wipe never gets one.

The certificate is not issued by the station. A second person reviews the wipe in the dashboard first. Until then the station shows Wiped and verified. The certificate waits for an admin., and the wipe shows as Pending Review in Drives, Wipe Records.

1. 1Open Wipe Verification. The count next to it in the menu is how many wipes are waiting.
2. 2Click Review on a wipe. The tabs Overview, Drive, Method and Verification show the full record. Check the drive serial and the method.
3. 3Click Approve & Issue Certificate.
4. 4Under Post-Sanitization Disposition, pick what happens to the drive: Transfer (sold or passed to another party), Reuse (kept in service) or Destroy. This is required. Disposition Detail, Downstream Vendor and notes are optional.
5. 5Click Approve & Generate. The certificate is issued and can be downloaded.

• Many at once: tick wipes in the list and click Review selected, up to 100 at a time. Each one is still checked on its own, gets its own certificate, and the result lists any that were not approved and why. Tick Approve only if every record passes to approve none unless all pass.
• Reject: click Reject, give a reason, and confirm with Reject Wipe. No certificate is issued for that wipe. To certify the drive, wipe it again: the new wipe is reviewed on its own.

Approving re-checks the whole record on the server. It refuses, with the reason on screen, when for example:

• the verification did not pass, or read back less of the drive than the wipe's level required;
• the drive's assurance level needs a Purge and the wipe was a Clear (see Assurance level);
• blocks were left that the wipe could not write, or that read back wrong with no known cause;
• the drive has a hidden area (HPA or DCO) that an overwrite did not reach;
• the station could not read the drive's serial, so there is nothing for the certificate to name;
• the record came from a demo wipe, where no drive was touched;
• you are the person who ran the wipe.

In each case the fix is on the drive, not on the record: wipe it again, or send it for physical destruction.

The PDF is titled Media Sanitization Certificate. It shows:

The Clear or Purge on the certificate is worked out by the server from the method that actually ran and the drive type. The certificate also says what it is not: it is issued by your organisation, and it is not a certification by NIST or any other standards body.

When an admin approves a wipe, reCore does three things:

1. 1Freezes the record. Everything printed on the certificate is stored as it was at that moment. It is never rebuilt from changing data later.
2. 2Takes a fingerprint. A fingerprint (SHA-256) is a short value worked out from every detail of the record. Change one character and the fingerprint changes. The verification code on the PDF is its first 16 characters, for example A1B2 C3D4 E5F6 A1B2.
3. 3Signs it. The record is signed with an Ed25519 digital signature. Only reCore's server holds the private key, so only it can make a valid signature. Anyone can check one with the public key. The PDF prints the key id.

The public keys are published, linked from the bottom of the verify page, for anyone who wants to check a signature themselves. When the signing key changes, the old public keys stay published, so older certificates still check.

Anyone holding a certificate, such as your customer, a buyer of the drives, or an auditor, can check it at /verify on this website.

• One certificate: scan the QR code on the PDF, which fills both boxes in. Or type the certificate id and the verification code. Spaces and dashes in the code don't matter.
• A whole lot: under Check many at once, paste one id and code per line, or upload a CSV. The results come back as a table, and Download results as CSV saves them.

A wrong code gets the same answer as an id that doesn't exist, so the page can't be used to find out which certificates exist. A match shows only what is needed to compare with the paper: issuer, issue date, drive, device serial, method, result and signature. It shows no names of people and no addresses.

• It proves the certificate matches the record reCore holds, that the record has not been changed since it was signed, and whether it has been revoked or replaced since.
• It doesn't inspect the drive. Compare the drive serial in the result with the drive in front of you. A genuine certificate for a different drive proves nothing about this one.
• It shows what the record says. The wipe itself was done and checked by the station, and approved by a person in the issuing organisation. The check confirms that record, not a new test of the drive.

Revoke a certificate when you find it is wrong, for example a wrong drive serial was recorded.

1. 1In Drives, Wipe Records, open the wipe and click Revoke certificate. (It is also in the certificate viewer.)
2. 2Type the reason, 5 to 500 characters. It is shown publicly, on the verify page and on the PDF.
3. 3Click Revoke certificate.

• Nothing is deleted. The PDF still downloads, with REVOKED across the page, and the verify page answers Revoked with your reason.
• The wipe then shows Revoked: review again, and an admin can review it again. Approving it issues a new certificate with a new id and code. The old one stays revoked.

• One: in Drives, Wipe Records, open a wipe marked Certified and click View Certificate, then download it from the viewer. Set the Certificate filter to Certified to list only issued ones.
• Many: tick certified wipes and click Download PDFs. Up to 200 certificates come as one merged PDF.
• At the station: once issued, a Download Certificate button appears on the wiped drive.

Send the PDFs to your customer, and point them to /verify so they can check each one, or the whole lot at once.