CNML Application

Certificate operations

The tools below generate sample CNML certificates for evaluation purposes. They run entirely in your browser. Private keys are generated on device, encrypted with a passphrase-derived key, and never leave your machine. Every operation is stateless on the server.

Issuing Authority

Create a certificate

Pick an OIML Recommendation, fill in the type-evaluation results, and sign a CNML certificate with a key generated in your browser.

Start creating →

Generate a CSR

Build a Certificate Signing Request for a new signing key. The CSR binds the public key to the IA identity and is submitted to BIML for the IA intermediate certificate.

Generate a CSR →

Manage signing keys

Generate ECDSA P-256 or composite Ed25519 plus ML-DSA-65 keys, import existing PKCS#11-backed keys, export encryped backups, and delete retired keys.

Open key manager →

Manufacturer

Issue an instance certificate

Sign a per-device instance certificate (tier 5) for each instrument produced, using a manufacturer-held delegated key generated in the browser. Produces a QR code and a downloadable certificate bundle.

Issue instance certificate →

Generate a QR code

Generate a QR code encoding the passport URL for a CNML instance certificate. The QR code is printed on the device body and resolves to the public passport page when scanned.

Open QR generator →

Market surveillance, customs, manufacturer

Verify a certificate

Drop a .cnml.xml file to run the verification pipeline (XML well-formed, schema valid, signature, issuer scope, CRL, timestamp, transparency). Files never leave your browser.

Open verifier →

Anyone

Browse sample certificates

Explore real OIML-CS Type Approval certificates reconstructed in CNML. Three samples per Recommendation are drawn from the published certificate corpus.

Browse samples →

Developer

Browse schemas

View the per-Recommendation JSON Schemas (draft-07) and the XSD that define the CNML certificate model. Each schema is the source of truth for a Recommendation.

Open schemas →

What these tools do and do not do

The tools are designed for evaluation of the CNML format and for prototyping new certificate types. They generate sample CNML certificates signed with locally generated keys. The certificates produced are valid according to the CNML schema and signature pipeline, but they are not OIML-CS type approvals.

Production certificate issuance within the OIML-CS framework requires an OIML-Designated Issuing Authority, a hardware key enrolled in the IA's threshold quorum, and a BIML-signed IA intermediate certificate. The tools here do not substitute for that institutional process. They help you understand the format, prototype the data model, and test the verification pipeline.

For the full architecture, the five-tier hierarchy, and the site-wide context, see the documentation.