Hydra

Overview

A secure, headless certificate management platform that enables organizations to issue, store, and verify digital certificates through cryptographic QR codes. The system implements ephemeral viewing links that strictly adhere to certificate expiration timelines - when a certificate expires, all access links automatically expire as well.

Core Functionality

For Certificate Issuers

• Upload and store certificate files (PDF format)
• Set expiration dates and manage certificate lifecycle
• Generate cryptographically signed QR codes for each certificate
• Update certificate files with complete version history
• Revoke certificates instantly when needed
• Regenerate QR codes to invalidate old ones
• View audit logs of all verifications

For Certificate Holders

• Access personal certificates using email verification
• Download QR codes for their certificates
• Check certificate validity status
• Request renewal notifications

For Verifiers

• Scan QR codes to verify certificate authenticity
• View certificate details without downloading
• Download verified certificates
• Real-time validity checking (expired/revoked certificates are rejected instantly)

Technical Architecture

Backend Stack

• FastAPI - Async web framework for high concurrency
• PostgreSQL - Primary database for metadata and audit logs
• Redis - Caching layer for session tokens and rate limiting
• MinIO / S3 - Object storage for certificate files
• Docker - Containerized deployment

Security Features

• HMAC-SHA256 Signatures - QR codes cannot be tampered with or forged
• Ephemeral Session Tokens - Maximum 15-minute validity, bound to certificate expiry
• Real-time Validation - Every file access checks current certificate status
• API Key Authentication - Secure access for issuers and admins
• Rate Limiting - Prevents brute force attacks
• Audit Logging - Complete trail of all access and modifications

Key Design Principles

1. No Long-lived Links - Every access requires fresh validation
2. Certificate-first Expiry - Links expire when certificates expire, never longer
3. Single Admin Constraint - System enforces only one active admin at a time
4. Complete Version History - All certificate updates are archived and reversible
5. Stateless Verification - QR codes contain all necessary cryptographic proof