1. Define exactly what is being certified
Before any design work, set down in writing what the certificate states: whether it records attendance, completion or an assessed achievement with a grade; how many hours or credits it represents; and whether it expires, as many professional certifications do, or records a fact that remains true, such as a degree.
The answers become the certificate's wording, and readers will take that wording literally. "Completed" and "passed" are different claims, as are "30 hours" and "3 ECTS credits".
2. Design one template per award
A template fixes the layout and the wording, and leaves placeholders for what varies from one recipient to the next: the name, the date, the grade or distinction, the reference number. A single template filled for each recipient keeps every certificate consistent, and consistency is itself a safeguard: a document that departs from the institution's pattern is easier to detect.
Our certificate design checklist lists the elements a professional certificate should carry, and how to keep it legible for every reader, including those who use assistive technology.
3. Assign each certificate a unique reference that cannot be guessed
Each certificate needs an identifier of its own. A readable serial number (2026-0042) serves the institution's records; a long random code is what keeps a verification link private and impossible to guess. Print both, or print the code as a QR code alongside a short verification address.
4. Sign it
A cryptographic signature computed over the certificate's exact wording allows a third party to confirm that the certificate was issued by the institution and has not been altered. A scanned autograph cannot provide that assurance. Our guide to digital signatures on certificates explains the difference and how the law treats each.
5. Deliver it in the formats recipients use
Graduates expect a PDF they can print and attach to an application. Employers expect a link they can open. Admissions systems and digital wallets increasingly expect a machine-verifiable credential, such as an Open Badges 3.0 credential, which follows the W3C Verifiable Credentials data model. Issue all of them from the same record, so they cannot contradict one another. Our comparison of PDF certificates and verifiable credentials covers the details.
6. Publish a verification page
A verification page answers what every reader needs to establish: whether this institution granted this certificate to this person, and whether it is still in force. It should show the recipient, the award, the date and the issuer, and state plainly whether the certificate is valid, expired or withdrawn. It should not require the reader to create an account.
7. Provide for corrections and withdrawals
Errors occur: a misspelt name, an incorrect date. A certificate that has been issued should not be edited: its signature covers the original wording, and a certificate changed without record cannot be relied upon. Issue a corrected certificate, withdraw the original, and have the original's verification page point to its replacement. The same mechanism serves when a certificate must be revoked for other reasons.
8. Maintain the register
Keep a record of every certificate: the recipient, the award, the date, the template used, and every subsequent change of status. That record is what allows the institution to answer a verification request years later. Our guide to certificate record retention addresses how long to keep it.
Issuing in bulk and through an API
A cohort of three hundred students should not require three hundred manual steps. Provide for importing a list, or for issuing from the learning platform through an API, so that the certificate is granted when the student completes the course. Ensure that a repeated request cannot issue the same certificate twice.
How Emitcert handles the process
In Emitcert, an institution designs its templates (wording, layout, colours, crest and up to three signatures) and grants certificates from its panel or through its API. Each certificate receives a unique serial and a code that cannot be guessed; its wording is copied in at the moment of issue and signed with the institution's own Ed25519 key. The recipient receives a link to a public verification page, a PDF and an Open Badges 3.0 credential. An error is corrected with "correct and reissue": the original is withdrawn and its page points to the corrected certificate.
Frequently asked questions
What makes a digital certificate verifiable?
A means for a third party to confirm, with the issuer or with the issuer's key, that the certificate was granted and has not been altered: typically a unique code, a verification page maintained by the issuer and a cryptographic signature over the certificate's wording.
May a certificate be edited after it is issued?
It should not be. The signature covers the original wording, so an edited certificate no longer matches it. Issue a corrected certificate, withdraw the original and have the original's verification page point to the new one.
Is a blockchain required to issue verifiable certificates?
No. The W3C Verifiable Credentials data model relies on cryptographic proofs that are checked with the issuer's public key. A signature and a published key are sufficient.
Should a certificate carry an expiry date?
Only if what it certifies expires. A professional certification that must be renewed should carry an end date; a degree or the completion of a course records a fact that remains true.
Sources
The factual statements on this page rest on the documents listed below. Legislation and services change; consult the current version before relying on any of them.