What is the Open Certificate Standard?
The Open Certificate Standard is an open, public format for the compliance certificates issued on residential property: gas safety records, electrical reports, fire safety certificates and the rest. It sets out what a certificate has to contain, how to give it a fingerprint that shows whether it has been changed, and a set of checks that software can run on it.
CertBox developed it, built the first working implementation and published both as a draft for comment at opencertificatestandard.org. Anyone can use it without paying, joining or asking. The specification is under the Creative Commons Attribution 4.0 licence and the test data and tooling under the MIT licence.
A certificate today is hard to check
A landlord handed a gas safety record gets a PDF. To know whether it is complete, they have to read it against the list in regulation 36 of the Gas Safety (Installation and Use) Regulations 1998. To know whether it is the one the engineer issued, they have to ring the engineer. Few people do either, so a missing detail tends to surface on the day somebody else asks to see the paperwork.
The data behind the certificate is no easier to get at. Each software supplier stores it in its own private shape, so a landlord’s compliance history sits inside whichever app their engineer happened to use. Changing engineer, agent or software means typing it all again or going without.
How the standard works
A small block of structured data holding the details a certificate needs: the property, the landlord, the engineer and their registration, the date, each item inspected and what was found.
The record is put into one fixed form, using the published JSON Canonicalization Scheme (RFC 8785), and hashed with SHA-256. Change a single character and the fingerprint changes. Two independent systems given the same record produce the same fingerprint, and nine published test cases let a developer prove theirs does.
Every requirement is written so that software can decide it. Is the landlord’s address there? Is each appliance described and located? Is there a result in words for each one? Are defects recorded, or is it stated that none were found?
The checks come in three levels, and each level includes the ones below it. They are set out in full in the specification.
| Level | Name | The question it answers |
|---|---|---|
| A | Valid | Does it contain everything the law names? |
| AA | Handover | Can a non-expert read it and act on it? |
| AAA | Evidenced | Can you prove, later, what was issued and to whom? |
If a certificate’s identity is one PDF file, a mistake in that file cannot be put right, because the corrected file looks like a forgery. Under the standard the identity is the data. A PDF, a web page and a printout of the same record are equally good, and a correction is a new record that points back at the one it replaces.
Why now: the rental property register
The Renters’ Rights Act 2025 sets up a national database of privately rented homes in England. The government’s Register your rental property service opens region by region from 15 December 2026, starting in the West Midlands. A landlord registering a property will need to provide a copy of the gas safety record, the electrical report or certificate, and the most recent EPC. The dates and the list are on the government’s own page.
That guidance asks for a copy. When we read it on 5 October 2026 it named no data format. So each certificate arrives as a document that a person has to read.
A shared format would let a register, an agent’s system or a landlord’s own records check a certificate the moment it arrives. We are offering this one early and in the open so that it can be argued with and improved before anyone has to rely on it.
What it means for you
You can see what a certificate is missing without waiting for someone else to find it, and confirm it is the one that was issued without a phone call. Records in an open format can move with you between engineers, agents and software.
A certificate your customer can check for themselves is one nobody needs to ring you about. A format that no supplier owns also means your certificate history does not have to stay with one app.
You do not have to invent a format. This one is specified, implemented and running, with test cases to prove your version agrees with everyone else’s. No company name appears in it, ours included.
How CertBox is leading this
CertBox is leading the field here. The trade had no shared, open format for a digital certificate, so we designed one, built it into our own software first and then gave the design away. The working software came before the specification, which is why every rule in it has already been run on real certificates.
A certificate issued through CertBox carries a QR code, and printed under it are the record’s fingerprint and the version of the standard. Scanning the code opens a verification page that shows the same fingerprint, so a person holding a printout can compare the two.
We chose to publish it openly, with no company name in the format, because a standard is only worth having if other suppliers adopt it too.
What the standard does not do
- •It is a draft, version 1, published for comment. No standards body has adopted it.
- •It does not make a certificate legally valid. That also rests on the competence of whoever did the inspection and the accuracy of what they wrote down. Where the standard and the law differ, the law applies.
- •It does not say how to inspect or test anything. That belongs to BS 7671, the Gas Safe Register, OFTEC, HETAS, BS 5839 and the regulations. The standard starts where the inspection finishes.
Read it, test it, tell us where it is wrong
Comments are wanted from software companies, letting agents, landlords, trade bodies and anyone working on the rental property register. The specification ends with a list of open questions.
- •The Open Certificate Standard: what it is and who it is for.
- •The specification, version 1: the record, the hashing rules and the checks.
- •Test vectors: nine records with their expected fingerprints.
- •The repository on GitHub: free to copy into your own test suite.
- •Open an issue: where other implementers can read it and disagree.
Sources
- •Renters’ Rights Act 2025: Part 2, Chapter 3 sets up the Private Rented Sector Database (legislation.gov.uk).
- •Get ready to register: the opening dates by region and the documents a landlord provides (UK government, read 5 October 2026).
- •Gas Safety (Installation and Use) Regulations 1998, regulation 36: what a landlord’s gas safety record has to include (legislation.gov.uk).
- •RFC 8785, JSON Canonicalization Scheme: the fixed form a record is put into before hashing (RFC Editor).
- •FIPS 180-4, Secure Hash Standard: the definition of SHA-256 (NIST).
- •Open Certificate Standard, version 1: the record, the hashing rules, the conformance levels and the open questions.
Questions people ask
Is the Open Certificate Standard free to use?
Yes. There is no fee, no membership and no registration. The specification is published under the Creative Commons Attribution 4.0 licence, and the test data and tooling under the MIT licence.
Who owns the Open Certificate Standard?
Nobody. CertBox developed it and wrote the first draft, but the licence lets anyone implement it, extend it or fork it, and no company name appears anywhere in the format. No standards body has adopted it yet.
Does meeting the standard make a certificate legally valid?
No. The standard checks that the details are present and that the record has not changed since it was issued. Whether a certificate is valid also depends on the competence of the person who did the inspection and the accuracy of what they wrote down. Where the standard and the law differ, the law applies.
How do I check a certificate issued through CertBox?
Scan the QR code on the certificate. It opens a verification page showing the record fingerprint. Compare it with the fingerprint printed under the QR code. If the two match, the details are the ones that were issued.
Issue certificates your customers can check
Gas, electrical and fire safety certificates from your phone, each with a fingerprint anyone can verify.
Free to fill in. £4.99 to send one, or £14.99 a month for as many as you like.
This article is for general guidance only and does not constitute legal or professional advice. Always check the current regulations, standards and manufacturer instructions that apply to your work and your jurisdiction.