Verification steps

  1. Load ToneThread Root public key…
  2. Verify Tenant Site Certificate signature…
  3. Verify Post Certificate signature…
  4. Recompute ToneHash of post content…
  5. Compare recomputed hash to certificate…

Revision history

Originally published 2026-05-02, updated 2026-05-18; 10 revisions (this active certificate plus 9 prior).

IssuedSupersededContent hash
2026-05-02T08:09:09.431Z 2026-05-02 08:11:08 tth_v1_9d7808a3032f4c02
2026-05-02T08:11:08.893Z 2026-05-02 08:11:34 tth_v1_9d7808a3032f4c02
2026-05-02T08:11:35.012Z 2026-05-03 08:35:20 tth_v1_9d7808a3032f4c02
2026-05-03T08:35:20.270Z 2026-05-05 01:55:06 tth_v1_9d7808a3032f4c02
2026-05-05T01:55:06.291Z 2026-05-05 02:38:25 tth_v1_d7cc40ea24f7544e
2026-05-05T02:38:25.876Z 2026-05-05 02:39:55 tth_v1_d7cc40ea24f7544e
2026-05-05T02:39:55.886Z 2026-05-06 14:18:13 tth_v1_d7cc40ea24f7544e
2026-05-06T14:18:13.945Z 2026-05-07 16:53:37 tth_v1_ac751c5f59e94532
2026-05-07T16:53:37.529Z 2026-05-18 11:12:27 tth_v1_2ef762c48c79cf29
2026-05-18T11:12:27.236Z — active — tth_v1_e3904285febbde0d

What this page exposes

Verification runs on the server. The browser only sees the public summary in the sidebar and the step-by-step ok/fail result above — never the certificate's raw signature, the tenant's raw public key, the ToneHash salt, the per-axis tonal scores, or the compact fingerprint string. Those stay on the signing host.

The public JSON at /tonehash/cert/e-mc-everything-made-complicated-when-not-clear mirrors the same surface. To independently audit a certificate's raw signed payload you must request an authenticated cert-bundle export from the operator — how to request access.