EuroCert.al: a certificate verification platform

The problem

A paper certificate is easy to copy. If a certification body can't offer a quick way to check one, then every dispute lands on the body and every buyer has to trust a PDF.

The client was an Albanian certification body. They needed a public place where someone holding a certificate could confirm that it was issued, to whom, and whether it was still valid.

What I built

EuroCert.al is a live certificate verification platform.

• Each issued certificate gets a unique, unguessable token.
• A QR code on the certificate points to a verification page for that token.
• Anyone can scan the code and see the certificate's details without logging in.
• The interface works in Albanian and English.
• The verification endpoint is rate-limited so it can't be used to guess tokens.

The standard security hygiene applies throughout: CSRF protection on forms, hashed passwords, prepared statements for database access and input validation.

The decision that mattered

The token. It has to be short enough to fit in a printed QR code, impossible to guess or enumerate, and quick to look up on the server. I used a long random value with an indexed lookup. The important point is that it is random. A sequential number would let anyone walk through the whole register.

Why the stack is plain

I built it in PHP with MySQL and server-rendered pages. The client's hosting was cPanel, the people maintaining it would not be Node specialists, and verification pages are mostly read-only. A plain server-rendered page is fast, works on weak connections and is easy to host anywhere.

That is a recurring theme in my work. The best choice is the one the client's team can keep running.

What I'd consider next

If the platform grows, a public API would let partners verify certificates from their own systems, and the read-heavy verification endpoint would be a natural candidate for caching.