What's the rule for using "who" or "whom"?
Which is correct?
A certificate is a statement that states who is entitled.
A certificate is a statement that states whom is entitled.
Is who a subject?
Forgetting for a moment about the technicalities of whether it is a subject or an object, if you use the rule of thumb of trying he/him it is clear that it should be "he is entitled" not "him is entitled". As such it should be "who".
In American English, whom is only used as the object of a preposition, if used at all. In your example, who is entitled is a nominal phrase taking the role of direct object of the verb state which is part of the relative clause modifying statement.
What counts is that 'who' is if you like the 'local' subject of clause ("who is entitled") in which it sits. To help you see where the clauses are, you could try turning the sentence round, e.g. turning the sentence round as follows more clearly indicates that the clause [Who is entitled] itself forms a constituent that is the subject of the main sentence:
So, according to the most common form of the traditional, arbitrary, prescriptive rule regarding "who" vs "whom", "who" would be used in this case.
But it is just a traditional, arbitrary prescriptive rule. There's no compulsion to follow it. So if you really can't decide, then I would suggest a really simply rule that you'll never get wrong:
It's a nice, simple rule that reliably produces sentences that sound natural to native speakers of English.