ISO 25500-110:2026

• Abstract:

  For the verification of certificates, this document specifies the requirements for three request types (verify certificate, resolve certificate, and search certificate) and the responses to these requests. The following are within the scope of this document: the syntax requirements and application protocol interface (API) for a request and response to a request to verify a certificate with an identifier formatted in accordance with ISO 8000-115 (verify certificate); the syntax requirements and API for a request and response to a request to verify a dataset of a certificate with an identifier formatted in accordance with ISO 8000-115 (resolve certificate); the syntax requirements and API for a request and response to a request to search for a certificate identifier formatted in accordance with ISO 8000-115 given a certificate recipient’s name (search certificate). The following are outside the scope of this document: the methods used for the resolution of certificates by the entity that issued the identifier.

• Status: Published
• Publication Date: 03-Nov-2026
• ICS: 35.240.63 - IT applications in trade
• Technical Committee: ISO/TC 184/SC 5 - Interoperability, integration, and architectures for enterprise systems and automation applications
• Current Stage: 6060 - International Standard published
• Start Date: 04-Nov-2026
• Completion Date: 04-Nov-2026

ISO 25500-110 is an ISO standard in the Supply chain interoperability and integration series. It specifies how to request verification, resolution, and search of certificates in the supply chain, using identifiers formatted in accordance with ISO 8000-115 and message exchange through a prefix name server (PNS). It is aimed at systems and organizations that need to verify certificate data with the issuing authority in an automated, interoperable way.

What does ISO 25500-110 specify?

ISO 25500-110 specifies the request and reply structures for three certificate-related processes: verify certificate, resolve certificate, and search certificate. It also sets the syntax rules for the related messages and the application interface protocol used to exchange them.

The document is organized into five clauses plus one informative annex:

Annex	What it covers
Annex A (informative)	Document identification for unambiguous use in an open information system

Clause 1 gives the scope. Clause 2 lists the normative references. Clause 3 points to the vocabulary part of the series. Clause 4 contains the main message and process rules. Clause 5 states conformance. The scope excludes the methods used by the entity that issued the identifier to resolve certificates.

What are the key requirements of ISO 25500-110?

ISO 25500-110 focuses on how a requestor and a certificate authority exchange certificate data through a PNS. In practice, the standard is about sending the right identifiers to the right party, then handling one of a small set of defined replies.

• Clause 4.1 introduces three supported processes: verify certificate, resolve certificate, and search certificate. This matters because systems need to choose the right transaction type for the task - confirming validity, retrieving the shared dataset, or finding an identifier from a recipient name.

• Clause 4.2.1 requires a verify request to include the registered ISO 8000-115 prefix of the requestor, the registered prefix of the respondent, and the ISO 8000-115 formatted identifier being checked. This lets both sides know who is asking and exactly which certificate identifier is under review.

• Clause 4.2.2 limits the verify reply to a small set of outcomes: syntax error, data error, request denied, timed out, or verified. This makes automated handling simpler because software can classify the result without parsing free text.

• Clause 4.3.1 defines the resolve request as a request for the dataset that the identifier represents. This is the step to use when the receiver needs more than a yes-or-no verification and needs the certificate data itself.

• Clause 4.3.2 requires the resolve reply to be in ISO 8000-114 interoperable data format (.idf). The reply must at minimum carry the certificate name, certificate description identifier, recipient name, recipient identifier if available, certified item if available, issue date, expiration date, and certificate agent if available. In practice, this tells implementers what minimum certificate record to exchange.

• Clause 4.4.1 and 4.4.2 define search by certificate recipient name. The reply returns one or more certificate identifiers in ISO 8000-115 format, or one of the same error states used elsewhere. This supports lookup workflows when the identifier is not yet known.

• Clause 5 ties conformance to applying the defined request and reply rules for verify, resolve, and search. For users, that means conformance depends on using the prescribed message structures and outcomes, not on any proprietary variation.

What terms does ISO 25500-110 define?

• Certificate - a representation of a record of an assertion or observation made by a third party.
• Certificate authority - the entity that issued the certificate and receives verification-related requests.
• Certificate recipient - the person, organization, or item named by the certificate.
• Prefix name server (PNS) - the routing point used to send requests and replies while keeping confidential electronic address information private.
• ISO 8000-115 prefix - the registered prefix used to identify a party in the exchange and support the identifier syntax.
• Certificate description identifier - the ISO 8000-115 formatted reference that identifies the domain covered by the certificate.
• Interoperable data format (.idf) - the ISO 8000-114 data format used for the resolve reply carrying certificate dataset information.

Who uses ISO 25500-110?

ISO 25500-110 is used by supply chain organizations that need to verify certificates for trading partners, products, services, or people. It is relevant to certificate authorities, requestors, system integrators, and operators of automated data exchange platforms.

It fits supply chain processes such as plan, source, make, deliver, return, and disposal. It is also useful where certificates are used for safety and health, ownership, compliance, training, licensing, quality, or service completion. Buyers and quality managers can use it to specify how certificate verification should work between systems.

Which standards are used with ISO 25500-110?

ISO 25500-110 refers to these standards for its terminology and message format:

• ISO 8000-114 - provides the interoperable data format used for resolve replies.
• ISO 8000-115 - provides the syntax and resolution requirements for quality identifiers used throughout the document.
• ISO 8000-116 - provides application guidance for authoritative legal entity identifiers.
• ISO 8601-1 - provides the date format used for certificate issue and expiration dates.
• ISO/DIS 25500-2 - supplies the vocabulary used in clause 3.

The introduction also names ISO 25500-1 and ISO 25500-100 as related parts of the industrial internet and supply chain data verification framework.

What does the ISO 25500-110 document contain?

ISO 25500-110 contains the request and reply rules for three certificate workflows, including the required fields in each request and the allowed response outcomes. Clause 4 gives the message content for verify, resolve, and search, and it distinguishes between the fast identifier check and the richer dataset response.

The resolve workflow includes a minimum certificate dataset in .idf form, with named elements for the certificate, recipient, dates, and related references. Clause 5 states how conformance is judged. Annex A provides an object identifier for unambiguous document identification in open information systems.

International
Standard
ISO 25500-110
First edition
Supply chain interoperability and
2026-11
integration —
Part 110:
Verification of certificates in the
supply chain
Interopérabilité et intégration dans la chaîne
d'approvisionnement —
Partie 110: Vérification des certificats dans la chaîne
d'approvisionnement
Reference number
© ISO 2026
All rights reserved.
This ISO publication is protected by copyright and is owned by ISO and/or its licensors.
The content of this ISO publication is provided under licence, not sold. Use is subject to the applicable licence terms issued by ISO,
an ISO member body, or an authorized third-party distributor.
Except as required for implementation or expressly permitted by a separate licence, no part of this ISO publication may be
reproduced, distributed, modified, used, or made available in any form or by any means – electronic or mechanical, including
photocopying, scanning, recording, or posting on internal or external digital platforms.
Any use beyond the scope of the granted rights is prohibited and may result in legal action.
ISO copyright office
CP 401 • CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Certificates in the supply chain: verification, resolution, and search processes . 2
4.1 General .2
4.2 Verify certificate: request and reply for certificate identifier verification .2
4.2.1 Request to verify a certificate identifier .2
4.2.2 Reply to request to verify a certificate identifier .2
4.3 Resolve certificate: request and reply for dataset certificate identifier represents .2
4.3.1 Request to resolve certificate to the dataset it represents .2
4.3.2 Reply to request to resolve certificate to the dataset it represents .3
4.4 Search certificate: request and reply for certificate identifier.3
4.4.1 Request for certificate identifier given certificate recipient name .3
4.4.2 Reply to request for certificate identifier given certificate recipient name.3
5 Conformance . 4
Annex A (informative) Document identification . 5
Bibliography . 6

iii
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO’s adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 184, Automation systems and integration,
Subcommittee SC 5, Interoperability, integration, and architectures for enterprise systems and automation
applications.
A list of all parts in the ISO 25500 series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.

iv
Introduction
A certificate is a representation of a record of an assertion or an observation of the occurrence of an event
by a third party. Common certificates include certificate for key life events such as birth, marriage or death
as well as certificates representing title to an asset such as land, a vehicle or shares in a company or to debt
as in a mortgage or loan note. Beyond those issued by government, certificates are commonly issued by an
organization to assert the completion of an event which they govern. A good example of this is education
certificates.
Certificates are some of the oldest written records with examples of certificates (written record) of birth
and land ownership over 4 000 years old. Registers of births and land appeared as early as the governments
themselves were formed to pass and enforce laws on its citizens and property ownership, if for no other
reason than the collection of taxes.
It is important to know if it is the register or the certificate which is authoritative. While the earliest registers
were compilations of authoritative certificates, today it is most common for the register to be authoritative
and for a certificate to be an extract of an entry in an authoritative register. With the conversion of registers
to digital form, the ability to quickly and easily access a register to verify a certificate is enhanced.
Certificates are essential to the functioning of the supply chain, from processes of plan, source, make,
deliver, return and disposal, to performance, people, and practices. There are certificates for potential
trading partners (i.e. safety and health inspected, minority-owned business, no forced or child labour, fair
trade, environmental responsibility, licenses), products (i.e. quality, safety, content, function), services (i.e.
completion of service), and people (i.e. trainings, licenses, education). The certificates must be verifiable with
the authoritative source (the entity issuing the certificate) and, given the need for interoperable, integrated,
efficient, and sustainable supply chains, through automated processing.
Certificates identify both a recipient and a certificate authority which is the certificate issuer. In order to
prevent possible fraudulent certificates or confusion on what the certification represents, the certificate is
verified with the certificate authority. ISO 8000-115 describes a quality identifier as definitive, resolvable,
and consisting of a prefix element (to represent the issuer of the identifier) a
...