Verify a Validation

WAF++ PASS Validation Certificate

This certifies that the infrastructure-as-code project — on branch — was reviewed against the WAF++ control catalogue and achieved an overall compliance score of —%.

Validation ID —

Project —

Branch / Commit —

Canonical hash —

Framework —

Stage —

— Compliance score

Signed by organization —

Countersigned by WAF++ validation gateway —

Certificate chain

Embeddable status badge

Teams can paste this badge into a README or compliance portal. It links to the live verification record served by the WAF++ validation gateway.

<a href="https://validate.waf2p.dev/api/v1/validations/<validation-id>/verify">
  <img src="https://validate.waf2p.dev/api/v1/validations/<validation-id>/badge.svg" alt="WAF++ validation" />
</a>

Downloadable artifacts

📄

Validation envelope JSON file with the full signed record, certificate chain, and run hash.

Open JSON

🏅

Printable certificate PDF document suitable for audit handouts and compliance folders.

Download PDF

🔍

Verification record Public API endpoint returning the signed status of this validation.

Open API

How verification works

The WAF++ validation gateway returns a signed verification record from /api/v1/validations/{validation_id}/verify. It contains:

• validation_id — the UUID of the validation.
• canonical_hash — the SHA-256 hash of the canonical run result.
• status — valid for active validations, or revoked.
• server_signature — the Ed25519 signature produced by the gateway intermediate key.
• certificate_chain — the gateway intermediate certificate and WAF++ root certificate in PEM form.

Anyone can independently verify this with the CLI:

wafpass verify --root-public-key waf++-root.crt wafpass-validation-<hash>.json

The gateway root certificate can be downloaded from the Root Cert page.