Test certificate
A development credential used for learning, demos, prototypes and controlled internal validation.
- Create and inspect manifests
- Validate signing integrations
- Demonstrate verification reports
Test or trusted certificate?
Both can create a cryptographically valid C2PA signature. Only a certificate chain recognized by the active trust context can support public trust.
- A valid signature proves that a signing operation can be checked. It does not automatically make the signer publicly recognized.
Prototype safely, deploy deliberately
The certificate choice should match the lifecycle stage and the trust expectations of the people who will verify the media.
Trusted production certificate
A production credential whose chain can be recognized by the relevant verifier trust policy.
- Managed production key security
- Recognized certificate path
- Appropriate ecosystem requirements
What changes at verification time
The same manifest format can lead to a different trust result because the credential and its certificate path are evaluated separately.
| Question | Test certificate | Trusted production certificate |
|---|---|---|
| Purpose | Development, demos, training and internal testing. | Production signing for a recognized target trust context. |
| Issuance | Often locally generated or issued for non-production use. | Issued and managed under applicable production requirements. |
| Signature validity | Can produce a cryptographically valid manifest signature. | Can produce a cryptographically valid manifest signature. |
| Chain recognition | Normally absent from public trust sources. | Depends on a valid path to a trust source recognized by the verifier. |
| Typical status | Often Signed, not recognised when all other checks pass. | Can support Trusted when all evidence and trust checks pass. |
| Best use | Prove the workflow works without claiming public trust. | Operate a production signing service with the required controls. |
Which certificate should you use?
Choose based on what the verification result needs to mean outside your own environment.
Building or demonstrating?
Use a test certificate to validate creation, signing, verification and reporting without representing the output as publicly trusted.
Use test signingPublishing with public trust?
Use production signing material whose certificate chain and operational controls meet the requirements of the target trust ecosystem.
Prepare production trustValid signature ≠ public trust
A verifier can confirm that a test-signed manifest is cryptographically valid while still marking its certificate chain as unrecognized. That separation is expected and should be visible to users.
Move from prototype to production
Treat production trust as an operational transition, not as a simple certificate-file replacement.
- 01Validate locally
Create manifests and confirm verifier behavior with test material.
- 02Define the trust target
Identify the verifiers and trust policy that must recognize the chain.
- 03Secure production keys
Apply access controls, rotation, logging and incident procedures.
- 04Verify end to end
Test signed outputs in the actual distribution and verification path.
Common questions
Use these answers when planning demos, pilots and production rollout.
Is a test-signed file invalid?
Not necessarily. Its signature can validate while its chain remains unrecognized, leading to Signed, not recognised.
Can we use private certificates internally?
Yes, with an explicit private trust policy. Make the scope clear and do not describe it as public ecosystem trust.
Does ProvSeal issue trusted certificates?
No. ProvSeal can support signing and verification workflows, but certificate issuance and public recognition depend on the applicable trust ecosystem.
Verify any file.
The ProvSeal extension reads the Content Credentials of an image, a video or a PDF right in your browser. No file is uploaded.