WAF++ PASS · Official Validation

Verify, share, and inspect WAF++ PASS official validation certificates.

The public, machine-verifiable source of truth for WAF++ compliance runs. Anyone with a validation ID can confirm that a run was countersigned by the WAF++ validation gateway.

Verify a validation How it works

What you can do here

🔍 Verify a validation

Enter a validation ID and server URL to retrieve the signed record, certificate chain, and status in real time.

🚫 Revocation list

Inspect the signed list of revoked validation IDs and download the machine-readable revocation envelope.

🛡️ Root certificate

Download the WAF++ root certificate and learn how to pin it for offline verification of official certificates.

📖 About

Read about the cryptographic design: Ed25519 signatures, canonical run hashes, X.509 chains, and offline verification.

Quick example

A validation link shared by a project looks like this: 

https://waf.lew-app.de/api/v1/validations/123e4567-.../verify

You can paste the validation ID into the verify page, or verify the envelope locally with the CLI: 

wafpass verify wafpass-validation-<hash>.json --root-public-key waf++-root.crt

All verification data is served directly from the WAF++ validation gateway. This registry site only renders the results in a human-readable form.