The observed image, video or document.
Trust guide
C2PA Certificates
Certificates connect a manifest signature to a signing credential and help a verifier evaluate the chain behind it.
A certificate supports cryptographic provenance. It does not prove that the scene, caption or claim in the media is true.
Chain of trust
From media to a trust decision
Verification follows several linked checks. A valid signature and a recognized certificate chain are related, but they are not the same result.
Declared actions, assertions and content bindings.
The credential associated with the manifest signature.
Intermediate certificates lead toward a trust anchor.
The verifier decides whether that chain is recognized.
Three roles
What certificates actually do
The certificate layer supports attribution of the signing credential and trust evaluation without making a judgment about the truth of the content.
The private key signs the C2PA manifest so relevant changes can be detected during validation.
The certificate provides information about the signing credential used to create the signature.
The verifier attempts to connect the signing certificate to an authority recognized by its trust policy.
Verification outcomes
One file, four clear states
ProvSeal separates evidence presence, cryptographic validity and public trust instead of collapsing them into a single yes or no.
Valid C2PA evidence and a certificate chain recognized by the active trust context.
The signature may validate, but the certificate chain is not recognized in the current trust context.
C2PA evidence exists, but an integrity, signature or validation check failed.
No C2PA evidence was detected in the observed asset.
Test and production
Same signing concept, different trust context
Testing proves that a workflow can create and validate manifests. Production trust requires an appropriate credential and recognized chain for the target ecosystem.
Test certificate
Useful for demos, development and internal validation. It should not be presented as a public trust signal.
- Prototype the signing flow
- Inspect manifests and reports
- Expect an unrecognized trust chain
Production certificate
Issued and managed for a production trust context. Recognition depends on the relevant ecosystem and verifier policy.
- Protect production signing keys
- Maintain the certificate chain
- Meet applicable trust requirements
What ProvSeal shows
Inspect every layer separately
ProvSeal can expose the manifest, signature validation, signing certificate and chain information in a detailed report. Its status summarizes the observed verification result without claiming that the media itself is true.
Quick answers
Common questions
Use these foundations before moving to trust lists, conformance or production signing.
Does a valid certificate prove the content is true?
No. It helps validate who or what signed the manifest and whether the signed structure remains intact.
Why can a valid signature be untrusted?
The cryptographic signature can validate even when its certificate chain is absent from the verifier’s recognized trust sources.
Can an organization use private trust?
Yes. A controlled workflow can recognize private credentials, but that internal decision must not be presented as public ecosystem trust.