Check a CertiStack report in your browser
Someone gave you a signed recovery report and you want to know that it has not been altered. Drop it here. Nothing is installed and nothing is uploaded. The CertiStack Enterprise Edition signs its reports; checking one here needs no license.
Your report never leaves this browser. This page reads the file on your machine and checks it with the browser's own cryptography. It makes no request while you use it, and it has no analytics and no third-party code. You can disconnect from the network, or save the page and open it from disk, and it works the same.
Try it with a real report
Nothing to hand yet? These two reports were written by CertiStack (schema 1.7) during a test run of a
demonstration Proxmox VE and Backup Server, and signed with a throwaway demo key, the way the Enterprise Edition
signs a report. They are real output, not mock-ups, and neither contains an address or name from a production network.
A Community run writes the same report without the signature members; certistack report show reads it.
- sample-pass.json: a restored web server answered an HTTP check on its sandbox address. The report says
all_passed: true. - sample-failed-probe.json: a run in which the web server answered but a second check, made through the guest agent, failed. The signature is valid, because the report is genuine, and the report says
all_passed: false: a valid signature is not a pass. - The demo signer's public key, to paste into step 2 (also as a file):
8f4e812dfada7f6e1765926a8c7d84ec930a15ffbd48f77c29b9348206d2d888
Drop a sample above with and without the key: without it the page says the report is intact but not whose it is;
with it, that the signer is the demo key. Change one character of a downloaded sample and verify it again to see a rejection.
The same files verify with certistack verify-report --keyring demo-trusted-signers.pub sample-pass.json.
What this checks, and what it does not
- It checks the signature. The page re-creates the report's canonical form (RFC 8785) and verifies the report's Ed25519 signature against the public key inside it. A valid result means the report is exactly what that key signed: no byte of any signed value has changed.
- It does not say who signed. The embedded key only says which key claims to have signed. Paste a key or fingerprint you trust in step 2 to check that this is the signer you expect.
- It does not say the recovery was good. A signed report of a failed recovery has a valid signature. Read
all_passedand the fields above, or runcertistack verify-reportwith--expect-*flags for the full acceptance verdict. - It does not check an unsigned report. A report from a Community run carries no signature, and this page refuses it as unsigned. Read it with
certistack report show, or runcertistack verify-report --unsigned --expect-outcome pass, which judges its contents but treats them as the run's own claim, not authenticated. - It does not verify timestamps. A report may carry a timestamp of its signature. The page tells you whether one is there; a test (“stub”) timestamp is not evidence, and no timestamp is verified here.
- It refuses what
verify-reportrefuses: a repeated member name, an integer of 2^53 or more, a signer key that cannot anchor trust, an oversized or deeply nested file.
Browser support: the signature check uses the Ed25519 support in WebCrypto: a current Chrome or Edge, Firefox 129 or later, Safari 17 or later. In another browser the page says so; it never shows a pass it did not compute. More in Verify without CertiStack and How a report is signed.