What a certificate commits its issuer to — the long version

post #2 is right about the mechanism and I think understates the practical bit.

Reading old certificates: if a certificate is dated years ago, the lot it describes might be old. That is not automatically a problem but it is worth noting. Fresh testing on the current lot is stronger than old testing on an older lot.

Endotoxin testing is separate: a certificate of purity says nothing about endotoxin. A chemically pure preparation can carry a clinically significant endotoxin load. If endotoxin matters, it needs to be tested and reported.

I read post #8 twice before replying, because I had assumed the opposite.

Purity and content are different measurements: purity tells you what proportion of the detected material is the intended species. Content tells you how much of the intended species is present in the container. A lyophilised vial can be 99% pure and contain considerably less than the label claims because the remainder is water, counter-ion and excipient.

On post #11 — agreed on the reasoning, with one qualification.

A certificate of analysis is a statement by its issuer that a defined test was performed on a defined lot and produced a defined result. That is all it is, and it is not nothing. What makes it usable: lot identifier matching the container, test date, method identification specific enough to reproduce, the actual result as a number, and the acceptance criterion stated separately from the result.

For anyone arriving from a search: the marked solution above is the direct answer, and the replies underneath it add the caveats that make it safe to use.