How to read a Geometer certificate.

What a certificate is

A Geometer certificate is a scoped record of one set of checks on one agent version. It says what was tried, what was found, who issued it and how to check that the record has not changed. It is not a seal of approval, and it does not say the agent is safe. We call it a certificate, never a certification.

This page is written for a security or risk reviewer who receives a certificate from a vendor. No issued certificate is published on this site yet, so use the illustrative example to practise. It is synthetic and unsigned, and no real project is assessed. The companion article, Read the scope before the signature, covers the same ground in a shorter form.

Read three gauges separately

The first part is what was tried and what was found. It lists the rules tested, the faults explored, the problems and, just as importantly, what was not checked. Read the not-checked part before the conclusion. A clean result covers only the cases that were tried.

Integrity is whether the record has changed since it was signed. It says nothing about whether the problems are right. A perfectly intact record can describe weak checks, and a record of weak checks can be perfectly intact.

Applicability is whether the certificate still matches the version you run. A later release, a changed rule or a different configuration can make an intact, accurate record irrelevant to your system. Check the version, the rules and the configuration it names against yours, and look for later rechecks or withdrawals.

The three gauges are shown apart on purpose. A strong reading on one never offsets a weak or unknown reading on another.

Scope and who issued it

Every certificate names its scope: the exact agent version, the actions and rules in it, the method and the budget of cases. Read it as a statement about that scope only. If the agent you run does more than the scope covers, the extra part is unassessed.

The certificate also prints the issuer's relationship to the subject. If the team that built the agent also ran the checks and issued the record, it says so, and it is not independent unless the certificate states otherwise. Self-issued evidence is still useful, because you can inspect and check it, but weigh it as the builder's own account.

The fingerprint and how to check it

The fingerprint is a short code computed from the exact contents of the record. Change one character and the fingerprint changes. If you get the fingerprint through a different route than the file, such as from the vendor's page or a call, a match tells you the file is the one that was fingerprinted.

To check a supported evidence pack, open the verify page and choose the files. They are read in your browser and stay on your device. The verifier checks the pack's ledger against the anchors you retained. Keep the date of the check with your decision, because applicability can change after integrity was confirmed.

What a certificate cannot tell you

It cannot tell you the agent will behave well in cases that were not tried. It cannot tell you that every action was recorded, that the vendor's wider process is sound, or that a regulator or auditor will approve. It does not predict how often something goes wrong, and it should not be turned into a percentage.

A fingerprint or signature identifies bytes and a signer. It does not make the underlying observations true.

Questions to ask the vendor

1. Which version did you check, and is it the version we will run? 2. What was not checked, and why? 3. Who ran the checks and who issued the record, and are they independent of the team that built the agent? 4. What changed since, and when will you recheck? 5. How do we get the fingerprint by a separate route and check the record ourselves? 6. What happens to our approval if a rule or the configuration changes?

Failures and incomplete certificates count

A certificate that records a failure is a valid certificate, and so is one that says the checks were incomplete. Be more cautious about a vendor who has only ever shown clean results. A record that reports a failure, the fix and the recheck gives you more to work with than a blank pass.