Yenta Girl Canvas Print
Every signature in the stored bundle checks out and the certificate is within its validity period. The register lists it as active — and anyone can confirm all of this offline, without trusting this server, using the commands at the foot of the page.
What this page is
A digital ID card for this one work. Sunlit Workshop’s own certificate authority issued it, and it names the serial, this public page, and a fingerprint that identifies the file. Anyone can check it with standard tools — no account, no trust in this server.
- Valid
- The workshop stands behind this identity today, and every signature in the file checks out.
- Revoked
- The workshop withdrew it. The page stays up as history, but the certificate should not be relied on.
- Expired
- Its dated window has passed. The record still stands; the workshop can issue a successor.
- Fingerprint
- A short code computed from the whole file. If a copy’s fingerprint matches the one on this page, it is the same certificate to the last byte.
This certificate proves the workshop issued an identity for serial SW-2026-257068. It does not prove the physical piece in your hand — for that, match the seal and the chip on the work’s record.
Who signs what: this identity certificate names the work and signs nothing. The work’s separate signing certificate signs the certificate PDF and countersigns the provenance record. Sunlit Workshop signs the record and publishes it to the public log. The countersignature is reserved for the registered owner and listed under Technical proofs on the record page.
The Work
The physical piece this certificate is bound to. The photograph is part of the signed record.
- Serial
- SW-2026-257068
- Kind
- Commission print
- Made
- 24 August 2026
- Description
- Yenta Girl, Printed in Layers
- Chip
- NFC · UID ending 2390
- Hologram
- 701085 · QC Label, Back Side, Bottom Center
Certificate details
The fields below are parsed from the signed certificate file itself — not typed in by hand. In plain terms: a certificate is a machine-checkable statement of who vouches for what, for how long.
The file's own number — not the work's serial, which is above.
The workshop issues a successor on this date, if it still stands.
The certificate names its own public record, so the file and this page can always be checked against each other.
Match this against the downloaded .pem — if even one character differs, it is not the same certificate.
Chain of trust
Root first. Each certificate signs the one below it; the chain ends at this work’s own certificate. The root is published openly, so the whole chain can be re-checked by anyone.
Record history
From the register’s own log — the work’s life so far, oldest first.
Verify this work yourself.
Scan the code, or match the serial and the SHA-256 fingerprint above against the signed certificate file itself.
provenance.sunlitworkshop.com/verify/SW-2026-257068Three commands, standard OpenSSL. They fetch the published roots and check every signature in the chain on your own machine.
curl -sO https://ca.sunlitbytes.com/ca/roots.pemcurl -sO https://provenance.sunlitworkshop.com/dl/SW-2026-257068/item-cert.pemopenssl verify -CAfile roots.pem -untrusted item-cert.pem item-cert.pem