Bind the manifest
The private key signs the C2PA manifest so relevant changes can be detected during validation.
Anatomy of a signing certificate.
Signing content with C2PA takes a certificate and its private key. Hover over the fields to see what the verifier checks, and what separates a test from public trust.
X.509 certificatev3 · content signing
SubjectWho signs
The holder’s identity: your organisation, its name, its country. This is what the verifier shows as the signer.
IssuerWho vouches for it
The certificate authority that issued the certificate. It must itself lead back to a trust anchor.
ValidityWhen
The period during which the certificate can sign. A signature made during that period remains verifiable.
Public keyWhat it is verified with
The public half of the key pair. The matching private key stays on your workstation, token or HSM.
Key usageWhat it is for
The extensions that restrict the certificate to content signing. A TLS certificate will not do.
ChainHow far back to go
Signing certificate → intermediate → root. If the root is on the C2PA Trust List, the status can be Trusted.
From media to a trust decision
Verification follows several linked checks. A valid signature and a recognized certificate chain are related, but they are not the same result.
- 01Media asset
The observed image, video or document.
- 02C2PA manifest
Declared actions, assertions and content bindings.
- 03Signing certificate
The credential associated with the manifest signature.
- 04Certificate chain
Intermediate certificates lead toward a trust anchor.
- 05Trust policy
The verifier decides whether that chain is recognized.
What certificates actually do
The certificate layer supports attribution of the signing credential and trust evaluation without making a judgment about the truth of the content.
Expose the credential
The certificate provides information about the signing credential used to create the signature.
Build a chain
The verifier attempts to connect the signing certificate to an authority recognized by its trust policy.
One file, four clear states
ProvSeal separates evidence presence, cryptographic validity and public trust instead of collapsing them into a single yes or no.
- TrustedValid C2PA evidence and a certificate chain recognized by the active trust context.
- Signed but untrustedThe signature may validate, but the certificate chain is not recognized in the current trust context.
- InvalidC2PA evidence exists, but an integrity, signature or validation check failed.
- No credentialsNo C2PA evidence was detected in the observed asset.
Inspect every layer separately
ProvSeal can expose the manifest, signature validation, signing certificate and chain information in a detailed report. Its status summarizes the observed verification result without claiming that the media itself is true.
Same signing concept, different trust context
Testing proves that a workflow can create and validate manifests. Production trust requires an appropriate credential and recognized chain for the target ecosystem.
Test certificate
Useful for demos, development and internal validation. It should not be presented as a public trust signal.
- Prototype the signing flow
- Inspect manifests and reports
- Expect an unrecognized trust chain
Production certificate
Issued and managed for a production trust context. Recognition depends on the relevant ecosystem and verifier policy.
- Protect production signing keys
- Maintain the certificate chain
- Meet applicable trust requirements
Common mistakes
What most often stands between you and the Trusted status.
- Signing in production with a test certificate
- Using a TLS certificate to sign content
- Leaving the private key on an unmanaged workstation
Common
questions.
Straight answers about certificates and trust.
Does a valid certificate prove the content is true?
No. It helps validate who or what signed the manifest and whether the signed structure remains intact.
Why can a valid signature be untrusted?
The cryptographic signature can validate even when its certificate chain is absent from the verifier’s recognized trust sources.
Can an organization use private trust?
Yes. A controlled workflow can recognize private credentials, but that internal decision must not be presented as public ecosystem trust.
PKI, without the PKI expertise.
During the pilot, we help you choose the authority and connect your certificate or your HSM.