Digital certificates: what the law says and what tech can do

"Certificate" is an umbrella term. In Germany, school reports are governed by state school acts, university certificates by higher education acts and university examination regulations, employment references by section 109 of the Trade Regulation Act (GewO), and vocational training certificates by the Vocational Training Act. Whether and how a certificate may be issued digitally therefore depends on its type.

What they share is that a digital certificate must answer two questions: is it legally the authoritative document — or only a copy? And can its authenticity be checked? The law answers the first question, technology the second.

For employment references the position is clear: under section 109(3) GewO the reference may be issued in electronic form with the employee's consent. Without consent it remains on paper.

Electronic form within the meaning of the German Civil Code means, under section 126a BGB, that the issuer adds their name to the electronic document and provides it with their qualified electronic signature. A scanned signature on a PDF does not meet that. Employers wishing to issue references digitally therefore need a qualified signature and documented consent.

For universities, state law and examination regulations determine the form in which certificate, diploma, Diploma Supplement and transcript are issued. Many universities still issue the original on paper and add a digital, verifiable version. Others already use digital originals with the university's electronic seal.

For international use the Diploma Supplement is important; under the states' study accreditation ordinances it is part of every degree certificate. For use abroad, a certification or apostille may also be required; whether that applies to digital documents depends on the destination country.

Technically, there are several ways to make a digital certificate trustworthy. They are not mutually exclusive but complement each other.

A good digital certificate is readable for people and verifiable for machines. A combination has proven itself: an appealing document with a QR code that looks exactly like what the verification page shows, backed by a signed credential under an open standard. A verifier sees the document as the holder received it at the top and the result of the cryptographic check below.

The lifecycle matters too: certificates can contain errors and must then be revoked and reissued. A revocation must show up on the verification page immediately. And the issuer must ensure that verification page and keys still work many years from now.

Anyone applying for a job or starting a degree abroad often has to present certified copies of certificates. For paper there are established routes; for digital certificates it depends on the destination country and the receiving body whether digital originals are accepted. European formats such as European Digital Credentials are designed precisely to be verifiable across borders without certification.

In recruitment, digital certificates make life easier for both sides: applicants send a link or file instead of copies, employers check authenticity in seconds. Employers should define in their processes which formats they accept and how they verify, and should not force applicants to disclose more data than the position requires.