Frequently asked questions

sec-certs crawls the official portals of Common Criteria, Protection Profiles, FIPS 140 and EUCC once a week, downloads the certification PDFs (certificates, certification and validation reports, Security Targets, security policies and maintenance reports) and converts them to text. It then extracts structured information using hundreds of hand-crafted rules and NLP/ML models, and links the resulting records to each other and to the NVD vulnerability database. Vulnerability data from the NVD is refreshed daily.

The processed dataset is published on this website, and the code is available on our GitHub.

sec-certs is built for anyone who would otherwise have to search through certification PDFs by hand. Typical users and how they use the tool:

• Vendors certifying their own product — technical managers with a strategic scope look up a product's certificate details, identify which laboratories have certified similar products, and build a dashboard of certifications within a given framework. Developers and technical leads look up a product's certificate, check for associated CVEs, and search for relevant Protection Profiles.
• Companies analyzing products to buy — use it to find a certificate for a product, check its associated CVEs, find products built on a given technology, and compare certificates across different versions of the same product.
• Research organisations — security researchers use it to identify which products are affected by a given vulnerability, compare certificates across product versions, and explore dependencies between certified products.
• Security-related testing laboratories — used it to find a product's certificate, identify which labs have certified similar products, build certification dashboards, and explore dependencies between products.
• National schemes and standardization organizations — use it to get an aggregated, cross-scheme view of the certification landscape to inform policy and standardization work.

The sources from which the certification documents can be found on the section Data of each of the frameworks:

• For Common Criteria, we use commoncriteriaportal.org as the main source (details)
• For Protection Profiles, we use commoncriteriaportal.org and niap-ccevs.org (details)
• For EUCC, we use certification.enisa.europa.eu as the main source (details)
• For FIPS 140, we use NIST CMVP, NIST CMVP Modules In Process and NIST CMVP Implementations Under Test (details)

First, try to use the filters on the search form. For most searches you will not need any special syntax. Depending on the framework, you can filter by ID, manufacturer, lab, status, category, scheme, assurance level, certification and archival dates, and extracted keywords. Selecting several values inside one filter matches any of them, while different filters narrow each other down: Schemes: DE, FR together with Status: active finds active certificates issued under either the German or the French scheme.

If the filters cannot express what you are after, you can switch to the advanced query syntax. This is useful when you want to use OR between two different fields instead of the default AND from the filters. It also lets you exclude terms, search for exact phrases, boost specific terms, and more. For details, query syntax guide explains what is available and how to use it.

The most common reasons:

The certificate is not (yet) in our dataset.

sec-certs crawls only a selected set of official portals for each certification framework, and does so once a week. If your certificate has not been added to the source portal yet, or was added after our last crawl, it will not appear yet.

What to do: Check the Data section of the relevant framework to see which sources are crawled and when the dataset was last successfully updated. Its Processing updates page lists every update run by date, so you can check whether your certificate was picked up in a recent one.

The search query syntax is incorrect.

See the query guide for the supported syntax.

The wrong search type is selected.

sec-certs offers two distinct search modes:

• Name search searches by product name, i.e., the title of the certificate.
• Fulltext search searches the text of all available certification documents (e.g., for Common Criteria, this includes the certificate, certification report, and Security Target)

What to do: If your term doesn't appear in a product's name, try switching to fulltext search, and vice versa.

It is any information on a certificate's page (e.g., matched CVEs/CPEs, references to other certificates, extracted vendor, algorithms, or keywords) that was produced automatically by our processing pipeline with non 100% certainty. These heuristics can contain false positives and false negatives, so they should be treated as a strong lead rather than a definitive fact — always cross-check against the linked source document. If something looks wrong, please use the feedback option on the certificate's page. If you want to know more how its computed and how to verify it, visit our documentation.

The data presented outside of the section Automated analysis refers to the fields that are directly extracted from the data sources, and thus, it should have been reviewed by a human.

It means our pipeline has heuristically linked that certificate to one or more CVE records from the NVD, most commonly because the certified product's configuration matched a CPE record listed as affected by those CVEs. This is a strong indicator, not a certainty — the affected feature may be outside the certified scope, disabled by default, or already patched in a maintenance update. Always verify against the certificate's Security Target or certification report before drawing conclusions.

A CVE is a unique identifier for a publicly disclosed vulnerability, and a CPE is NIST's standardized identifier for a product/version/vendor configuration; the NVD maintains the mapping from vulnerable CPEs to the CVEs affecting them.

Our tool automatically matches a certified product's name and extracted version(s) against candidate CPE records using vendor and version constraints plus fuzzy string similarity, and treats a certificate as affected by any CVEs associated with a matched CPE.

On a certificate's page, the Automated analysis section shows the CPE matches our tool matched to the product, while CVE matches shows the specific vulnerabilities inferred from those matches. Because this matching is automated, it can miss vulnerable products (if no CPE was matched) or over-report them (if a match is too loose or the vulnerable feature was excluded from the certified scope). For authoritative confirmation, always consult the linked NVD entry, the certificate's Security Target/security policy, and, where relevant, the vendor's own advisories.

Cross-references (or just "references") are links our tool detects between two certificates, typically because one certificate's documents mention the identifier of another (e.g., a smartcard certificate referencing the certificate of its underlying chip). They usually signal that the referencing product reuses or builds upon a certified component, or that it is a re-evaluation/newer version of the referenced product.

The reference graph is available for Common Criteria and FIPS 140 certificates under References. It visualizes certificates as nodes and references as directed edges. Use it to explore what a product depends on, what depends on it, or how far a potential vulnerability might propagate through the ecosystem.

Each certificate's page has a Processing updates tab that logs the history of our processing pipeline for that certificate, e.g., when it was first processed, when its source PDF or metadata changed, or when its computed heuristics (such as matched CPEs/CVEs) were recomputed, together with a diff of what changed. It lets you track a certificate's history over time and see exactly what changed since your last visit.

It is a machine-readable web feed you can subscribe to with a feed reader (or your own tooling) to get notified of new or changed certificates matching your interests, as an alternative to email notifications. It follows the standard Atom syndication format, so any standard feed reader can consume it.