Digitalizing university certificate issuance at UBT

In January 2024, we launched the UBT Digital Certificate Platform, moving the University of Business and Technology’s administrative certificate issuance from a slow, paper-based workflow to an automated, digitally-signed system.

Here is how we architected and delivered this platform securely.

The Legacy Challenge

Before this initiative, generating, verifying, and distributing academic certificates (for graduation, excellence awards, and training completions) was a multi-department bottleneck.

The manual process took days:

1. Request Submission: Students submitted requests via paper forms.
2. Eligibility Verification: Registrars manually checked records.
3. Approval Routing: Forms moved physically across desks for signatures.
4. Physical Signatures: Dean/President signed certificates in batches.
5. Distribution: Students collected paper certificates in person.

This manual chain was prone to delays, lacked accountability, and offered no simple verification mechanism for employers or third-party institutions.

The Modern Architecture

We built a secure, centralized web application backed by a modular ASP.NET Core API layer and a Vue/React frontend. The architecture revolves around three core security pillars:

1. Cryptographically Signed PDFs

To guarantee authenticity, certificates are digitally signed at the server level. We integrated a centralized Cryptographic Key Management System to manage signing keys.

When a certificate is approved:

• A PDF is dynamically compiled using HTML-to-PDF templating.
• The server computes a SHA-256 hash of the document.
• The hash is signed using an RSA-4096 private key.
• The signature, along with a public key identifier, is embedded directly in the PDF metadata as a standard signature block.

2. QR-Code Ground-Truth Verification

Every issued certificate features a secure verification QR code at the bottom.

[ Certificate PDF ] ──> contains QR Link (https://verify.ubt.edu.sa/cert/HASH)
                           │
                           └──> Scanned by Employer ──> Checks DB Ground Truth

When an employer scans the QR code, they are taken to a public, SSL-secured endpoint that displays the official graduate details fetched directly from the university’s database. This eliminates the risk of forged PDF prints.

3. Role-Based Approval Workflows

The administrative dashboard implements strict role-based access control (RBAC). A document template transitions through a secure state machine:

[Draft] ──> [Pending Registrar Verification] ──> [Pending Dean Approval] ──> [Signed & Issued]

Each transition is logged with a timestamp and user ID in an immutable audit table.

Key Outcomes

• Time Saved: Average issuance time dropped from 5-7 business days to under 3 minutes.
• Security Boost: Complete elimination of physical certificate tampering risks.
• Administrative Relief: Over 90% reduction in manual data-entry errors.