Back to the C=US proposal

Signed email, 2026-10-03

Verify Claude's email on mutual TLS for people and AI agents

Claude (Anthropic) wrote this email at Peter Bachman's request, as input to the CA/Browser Forum clientAuth charter discussion. The key that signed it is held on a YubiKey (PIV slot 9C) and cannot be exported. Its certificate is issued by the c=US demonstration root, whose key is on the same YubiKey (slot 82). The evidence it cites is at mtls-evidence/2026-10-03, signed the same way.

DEMONSTRATION ONLY. The c=US root is a self-signed project root, not a public certificate authority. A valid signature shows the message was signed by the holder of this certificate's key and has not changed. It does not show more than that unless you trust the root fingerprint below.

Files

• message.txt: the exact signed bytes (UTF-8, LF line endings, no trailing newline)
• message.sig: the signature, DER-encoded ECDSA P-256 / SHA-256 (base64)
• claude-signer-cert.pem: the signer's certificate
• c-us-root.pem: the c=US demonstration root

Fingerprints

The signer certificate was issued to the project's Claude signing key when it was created in an earlier session; that's why the name includes a session ID.

Verify with OpenSSL

Download the four files into one folder, then run:

# 1. The signer certificate is issued by the c=US root
openssl verify -CAfile c-us-root.pem claude-signer-cert.pem

# 2. Compare the root fingerprint with the one above
openssl x509 -in c-us-root.pem -noout -fingerprint -sha256

# 3. The message was signed by the signer certificate's key
openssl x509 -in claude-signer-cert.pem -pubkey -noout > claude-pub.pem
openssl dgst -sha256 -verify claude-pub.pem -signature message.sig message.txt

Expected output: claude-signer-cert.pem: OK, the fingerprint above, and Verified OK. If the message has changed by even one byte, the last step prints Verification failure.

Verify with Python

pip install cryptography
python - <<'EOF'
from cryptography import x509
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
leaf = x509.load_pem_x509_certificate(open("claude-signer-cert.pem", "rb").read())
root = x509.load_pem_x509_certificate(open("c-us-root.pem", "rb").read())
leaf.verify_directly_issued_by(root)
leaf.public_key().verify(open("message.sig", "rb").read(), open("message.txt", "rb").read(),
                         ec.ECDSA(hashes.SHA256()))
print("OK, root", root.fingerprint(hashes.SHA256()).hex().upper())
EOF

If you received the email

Mail clients may change spacing or line breaks, so check the copy in message.txt rather than the text you received. If the two read the same, the signature covers what you were sent.