It can establish recognition
The verifier can determine whether the certificate path leads to a trust source accepted in the active ecosystem or policy.
- Recognized trust anchors
- Certificate-chain context
- A basis for a Trusted status
How a verifier decides.
The C2PA Trust List brings together recognized trust sources. A valid signature is not enough: its chain has to lead back to one. Pick a case and watch the chain resolve.
Signing certificate
self-signed
self-signed
Root
Root not on the list
Root not on the list
Signed but untrusted
The signature is valid, but nothing ties it to a recognized source.
The signature is valid, but nothing ties it to a recognized source.
Signing certificate
issued by a CA on the list
issued by a CA on the list
Root
Root on the list
Root on the list
Trusted
The chain leads back to a trust anchor recognized by the C2PA list.
The chain leads back to a trust anchor recognized by the C2PA list.
Signing certificate
issued by a CA that is not listed
issued by a CA that is not listed
Root
Root not on the list
Root not on the list
Signed but untrusted
The certificate may well be sound, but it is not recognized in this verification context.
The certificate may well be sound, but it is not recognized in this verification context.
Signing certificate
after signing
after signing
Root
Integrity check failed
Integrity check failed
Invalid
The hash no longer matches: the chain no longer counts.
The hash no longer matches: the chain no longer counts.
How a verifier reaches a status
Trust is the last part of a sequence. A file can fail earlier, or it can pass cryptographic checks without reaching a recognized trust anchor.
- 01Manifest found?
If not, the result is No credentials.
- 02Asset matches?
Validate the signed relationship to the observed media.
- 03Signature valid?
Failed cryptographic checks can produce Invalid.
- 04Chain recognized?
Evaluate the certificate against the active trust context.
- 05Status explained
Show Trusted or Signed but untrusted with details.
Keep signature and trust separate
Clear labels prevent a technically valid signature from being mistaken for public recognition.
- TrustedEvidence validates and the certificate chain is recognized in the current trust context.
- Signed but untrustedSigned evidence exists, but its chain is not recognized by the active trust sources.
- InvalidA validation failure prevents the credential from being treated as valid evidence.
- No credentialsNo C2PA manifest was detected in the observed asset.
Show the reason behind the badge
ProvSeal presents a concise status, then lets users inspect the manifest, signature, certificate and chain details. This makes local tests, private signing and public trust easier to distinguish.
What a trust list says — and what it does not
A trust list is a technical input to certificate validation, not a universal endorsement of every statement inside a credential.
It does not establish truth
Recognition does not independently prove the scene is real, a caption is accurate or every declared action is complete.
- No fact-checking of the media
- No guarantee of author intent
- No replacement for editorial review
Public recognition and private policy
Organizations can make internal trust decisions, but those decisions should be described separately from ecosystem-level public trust.
Public ecosystem trust
The certificate chain is evaluated against recognized public trust infrastructure applicable to the verifier.
Publicly recognized contextPrivate organizational trust
A newsroom, brand or platform explicitly accepts an internal credential for a controlled workflow.
Private policy contextThree public lists with different roles
The Conformance Explorer separates product conformance from the trust anchors used for signing and time stamping.
Conforming Products List
Records products evaluated under the C2PA Conformance Program. It is not a certificate trust list.
C2PA Trust List
Contains X.509 trust anchors for authorities that issue certificates to C2PA signers.
C2PA TSA Trust List
Contains separate trust anchors for Time Stamping Authorities.
The Interim Trust List is retired and frozen
The official C2PA Trust List replaced the temporary Interim Trust List. Legacy credentials may still need explicit handling, but new entries and updates are no longer added to the ITL.
Common
questions.
Straight answers about trust lists and statuses.
Can a signature be valid but untrusted?
Yes. Cryptographic validity and recognition of the certificate chain are separate checks.
Can a company trust its own certificate?
Yes, inside a private policy. That does not automatically create public C2PA ecosystem trust.
Does Trusted mean the content is true?
No. It describes validated evidence and recognized signing context, not the factual accuracy of the media.
A certificate that leads back.
During the pilot, we help you obtain a certificate whose chain leads back to the C2PA Trust List.