Digital Certification

Digital Certification generates a third-party timestamped "birth certificate" for your artwork: who owned which file at what moment in time, and proof that the file hasn't been altered since.

When to use it

• The day a piece is finished — the best moment to certify; the earlier the timestamp, the better
• Before publishing to public platforms — lock in the original state before release
• Before delivering commissioned work — prove creation time and ownership, so a client can't dispute it after the fact
• Before submitting to a competition — many contests require proof of originality
• Regular batch archiving — certify a batch of pieces at once to build a creation timeline

How to use it

Find the "Digital Certification" card (stamp icon) in the toolbox:

1. Select files — drag and drop or click to choose the artwork files you want to certify
2. Enter author info — your name (written into the PDF report and the certification manifest)
3. Confirm the certification mode
   • Lite certification — used automatically when you only have finished images (PNG/JPG/WebP)
   • Full certification — automatically upgraded when source files such as PSD / CLIP / SAI / KRA / Procreate are detected
4. Click "Start Certification" — the app computes hashes, builds a Merkle Tree, requests a TSA timestamp, and generates the report, in that order
5. Review the result — once done, the app writes the certification package and report into a dedicated output folder; you can go straight to "View Certification Report" or "Open Folder" to retrieve the .nep file

Understanding the output

After certification, the output directory contains:

Structure inside the .nep package

evidence.nep (ZIP)
├── manifest.json
├── proof.tsa / proof.json
├── VerificationReport.pdf
├── thumbnail.jpg
└── works/
    ├── 000_artwork.png
    ├── 001_artwork.psd
    └── ...

Verifying a certification

Method 1: Verification website

The PDF report carries a QR code and a verification link:

https://verify.arisfusion.com?id=<first 16 chars of root_hash>

Method 2: Have Nephele verify the timestamp token

Inside the app, hand Nephele a timestamp token file (.tsr / .tsa / .json); it will read the token, parse the issuing time and issuing authority, check the hash, and tell you whether the token is valid. This step verifies the timestamp token itself; to also check integrity against the original files, use the verification website in Method 1.

Method 3: Manual verification (advanced)

If you have the TSA's certificate chain file, you can verify with OpenSSL:

openssl ts -verify -in proof.tsa -data <original file> -CAfile <TSA cert chain>

Lite certification vs. Full certification

Offline certification and TSA fallback

If the timestamp server can't be reached during certification (network failure, proxy issues, server maintenance), Nephele automatically falls back to a local timestamp:

• Generates proof.json instead of proof.tsa
• The PDF report is marked "Local timestamp, not certified by a third-party TSA"
• File hashes and the Merkle Tree are still computed correctly; only the authoritative time backing is missing

Recommendation: re-certify once your connection is restored to obtain an authoritative TSA timestamp. The local timestamp serves only as a temporary backup.

Password protection (optional)

.nep files support AES-256 password protection. Once a password is set, the certification package is encrypted. Note:

• Requires pyzipper to be installed (pip install pyzipper)
• If it isn't installed, the password setting has no effect and the app will let you know
• Keep your password safe — if it's lost, the files inside the package cannot be recovered