A C2PA certificate is used in the signing and verification process for C2PA manifests.
When a tool creates Content Credentials, it signs the C2PA Manifest with a private key. The corresponding certificate helps validators understand who or what signed the manifest and whether that signer can be trusted under a specific trust policy. See the guides on C2PA certificates and signing certificates, and Security & Trust.
What a C2PA certificate does
A C2PA certificate helps answer technical trust questions such as:
- Which signer created the manifest?
- Was the manifest signed with a valid key?
- Does the certificate chain to a trusted source?
- Was the credential signed during the certificate’s validity period?
- Is the signer recognized by the validator’s trust policy?
The certificate does not prove that the visual content is true. It supports provenance verification by helping establish who signed the manifest and whether the signed data is intact.
Test certificates vs production certificates
A test certificate is useful for learning, demos, internal validation and development. It can help a team confirm that signing and verification flows work correctly.
A production certificate should be issued and managed according to the trust requirements of the target ecosystem. For public trust, the certificate chain needs to be recognized by the relevant trust list or trust policy. If trust is not recognized, verification may show Signed but untrusted.
Certificates in ProvSeal
ProvSeal supports local test-signing workflows and helps users inspect certificate details during verification.
When a file is verified, the extension can show whether C2PA data exists, whether the signature is valid, and whether the certificate chain is recognized as trusted.
This makes it easier to test the difference between a local demo identity and a production-ready C2PA signing workflow.