How to Verify a CoC Vault URL Is Genuine

Step 1: Visit the URL

The Primary Verification Method

The simplest way to verify a CoC Vault URL is to visit it in a browser. The URL takes the form: certificatesofconformity.co.za/v/[sha256hash]. When visited, it resolves to the CoC verification page showing all the CoC metadata: the reference number, the issuing body, the issue date, the goods description, the HS code, the importer name, the manufacturer name, the country of origin, the applicable SANS standards, and the CIF value.

If the URL resolves to a verification page with the correct CoC metadata, the CoC is registered on CoC Vault and is authentic. If the URL shows "Unknown CoC," the CoC has not been registered on CoC Vault, or the URL has been altered.

SARS Customs officers can verify a CoC Vault URL in the same way — by visiting the URL in a browser or by scanning the QR code on the verification page.

Step 2: Check the Metadata

Confirm the CoC Covers the Shipment

After visiting the verification URL, check that the CoC metadata matches the shipment. The goods description on the verification page should match the goods in the shipment. The HS code should match the HS code on the SAD 500 declaration. The importer name should match the importer of record.

If any of the metadata does not match the shipment, the CoC may have been issued for a different shipment or may have been altered. Do not use a CoC that does not match the shipment.

SARS Customs will perform the same metadata check when verifying a CoC Vault URL. If the metadata does not match the SAD 500 declaration, SARS Customs will reject the CoC and detain the goods.

Step 3: Verify the SHA-256 Hash

Advanced Tamper Detection

For advanced verification, you can confirm that the CoC PDF has not been altered by calculating its SHA-256 hash and comparing it to the hash in the verification URL. The hash in the URL is the 64-character hexadecimal string after /v/ in the URL.

To calculate the SHA-256 hash of a PDF, use a SHA-256 hash calculator (many are available online) or use the command-line tool: sha256sum filename.pdf (on Linux/Mac) or certutil -hashfile filename.pdf SHA256 (on Windows). If the calculated hash matches the hash in the URL, the PDF is authentic and has not been altered.

This advanced verification step is not required for routine compliance checks but is useful when there is a specific concern about document authenticity.

What If the URL Shows Unknown CoC?

Troubleshooting

If the CoC Vault URL shows "Unknown CoC," there are three possible explanations: (1) the CoC has not been registered on CoC Vault — the importer needs to register it; (2) the URL has been altered — someone has changed the hash in the URL, which would indicate an attempt to present a different CoC; or (3) the URL is incorrect — there may be a typo in the URL.

If you receive a CoC Vault URL from an importer and it shows "Unknown CoC," contact the importer immediately and ask them to verify the URL. Do not submit a SAD 500 declaration with an unverified CoC Vault URL.