1. Before accepting or rejecting a certificate
Keep registry access separate from certificate validity. The panel below measures whether each front door answered. It does not establish whether any certificate was genuine.
Status codes, three rounds each, 9 August 2026. All target and path combinations except one returned the same status across three rounds: the proxied ISO path returned 302 once and 403 twice.
| Registry | What buyers use it for | Direct (from China) | Via proxy egress |
|---|---|---|---|
| IAF CertSearch | Management-system certificates (ISO 9001 family) | 200 | 200 |
| UL Product iQ | UL listings incl. UL 2849 / UL 2271 | 403 | 403 |
| EU compliance space (webgate) | Notified bodies behind CE routes | 200 | 200 |
| FCC | Equipment authorization entry | 403 | no answer |
| ISO | Standard listings | 403 | 302 / 403 |
| ILAC | Accreditation-body recognition | 200 | 200 |
| CNAS (English) | Chinese accreditation body | 200 | 200 |
| NHTSA vPIC | VIN decoding, manufacturer records | 200 | no answer |
| Control: Chinese commercial host | — | 200 | 200 |
| Control: international host | — | no answer | 200 |
The Chinese control returned 200 on both paths. The international control returned no HTTP status direct and 200 via proxy. These controls show differing responses; they do not locate an egress or explain each failure.
2. Three findings
- Does ISO issue the certificates in this panel?
ISO does not issue certificates. The panel includes certificate searches, accreditation directories, standards pages and vehicle records. Its homepage is not a certificate-holder register.
- Why did the scripted UL check fail?
UL returned 403 on both tested paths with the same browser user-agent. The panel did not establish why the request was refused or what an interactive browser would return. Check the relevant listing and holder separately.
- Does a proxy make these sites easier to reach?
Direct requests got 403 from FCC and 200 from vPIC. The proxy requests returned no HTTP status for either. The failure cause was not established. These results do not show whether another path would help.
Source: ISO certification guidance. Related: ebike document checks and the official-source access panel.
3. Method, and what this panel cannot say
- Front doors only. Three GETs per host per path to the root or stated entry path, desktop-browser user-agent, no logins, no queries, no CAPTCHA interaction. A 200 on the root does not prove a search completes. A 403 to our client does not establish the result of an interactive session.
- One date, one connection per path. Availability is a dated fact: a host that refuses this week may serve next week, and a different ISP or egress may behave differently. Citing any row without its date misrepresents it.
- “No answer” means no HTTP status was recorded within the 25-second request limit. The saved zero status does not identify a TLS failure, a block or a server decision.
- Controls have limits. The international control failed on the direct path, while several other overseas sites returned 200. This rules out a total failure to reach overseas sites. It does not isolate the cause of any one host’s response.
For your own certificate check, record the source, date and result. If access fails, leave the claim unresolved and seek another check through the issuer. These dated status codes do not verify any certificate.
A separate count of Chinese platform records
A separate run queried qualification and licence records for 45 company codes selected for our study based on the NHTSA vehicle-manufacturer list. The saved file is dated 21 August 2026. These are counts returned by a Chinese business-information platform, not checks of the eight sites above.
| Record | Companies | Median returned count |
|---|---|---|
| Qualification certificates | 36 of 45: 80% | 8 |
| Administrative licences | 40 of 45: 89% | 5.5 |
Medians use only companies with records returned: 36 for qualifications and 40 for licences. Some responses stop at 20 records, so these are returned counts, not complete holdings.
This run did not test whether the records were current or covered the goods being bought. It also did not establish their overlap with foreign listings. Check the specific issuer, holder and product scope for your order.
Citing this study
You are welcome to quote or reproduce these observations, including commercially, provided the date I checked it (9 August 2026) and the stated limits travel with them. Machine-readable results: the full panel JSON. Related measurements: the Chinese official-source panel and the research index.
Archived copies, each with its own DOI, resolving independently of this site: Zenodo · Harvard Dataverse. Both hold this study’s own data file. An earlier Zenodo link on this page pointed at the related official-source availability panel, which does not contain this study’s files. That link was removed on 21 August 2026 and the correct record is the one above.
A citation with everything it needs:
Currawong, “Certificate registries: who can actually open them?”, eight verification-related sites probed three rounds each over two network paths with same-session controls, 9 August 2026.
https://currawongweb.com/verify/verify-certificates-from-china/Dataset:https://doi.org/10.7910/DVN/UAFGUT
BibTeX
@dataset{currawong_verify_certificate_registry_access_study_2026,
author = {Bao L. Zhou},
title = {{Dual-path availability of certificate-verification registries}},
year = {2026},
publisher = {Zenodo},
doi = {10.5281/zenodo.21947625},
url = {https://doi.org/10.5281/zenodo.21947625}
}