Test certificate
A development credential used for learning, demos, prototypes and controlled internal validation.
- Create and inspect manifests
- Validate signing integrations
- Demonstrate verification reports
Certificate comparison
Test vs Trusted Certificate
Both can create a cryptographically valid C2PA signature. Only a certificate chain recognized by the active trust context can support public trust.
A valid signature proves that a signing operation can be checked. It does not automatically make the signer publicly recognized.
Two environments
Prototype safely, deploy deliberately
The certificate choice should match the lifecycle stage and the trust expectations of the people who will verify the media.
Trusted production certificate
A production credential whose chain can be recognized by the relevant verifier trust policy.
- Managed production key security
- Recognized certificate path
- Appropriate ecosystem requirements
Side by side
What changes at verification time
The same manifest format can lead to a different trust result because the credential and its certificate path are evaluated separately.
| Question | Test certificate | Trusted production certificate |
|---|---|---|
| Purpose | Development, demos, training and internal testing. | Production signing for a recognized target trust context. |
| Issuance | Often locally generated or issued for non-production use. | Issued and managed under applicable production requirements. |
| Signature validity | Can produce a cryptographically valid manifest signature. | Can produce a cryptographically valid manifest signature. |
| Chain recognition | Normally absent from public trust sources. | Depends on a valid path to a trust source recognized by the verifier. |
| Typical status | Often Signed but untrusted when all other checks pass. | Can support Trusted when all evidence and trust checks pass. |
| Best use | Prove the workflow works without claiming public trust. | Operate a production signing service with the required controls. |
Decision guide
Which certificate should you use?
Choose based on what the verification result needs to mean outside your own environment.
Building or demonstrating?
Use a test certificate to validate creation, signing, verification and reporting without representing the output as publicly trusted.
Use test signingor
Publishing with public trust?
Use production signing material whose certificate chain and operational controls meet the requirements of the target trust ecosystem.
Prepare production trustMigration path
Move from prototype to production
Treat production trust as an operational transition, not as a simple certificate-file replacement.
Create manifests and confirm verifier behavior with test material.
Identify the verifiers and trust policy that must recognize the chain.
Apply access controls, rotation, logging and incident procedures.
Test signed outputs in the actual distribution and verification path.
Critical distinction
Valid signature ≠ public trust
A verifier can confirm that a test-signed manifest is cryptographically valid while still marking its certificate chain as unrecognized. That separation is expected and should be visible to users.
Quick answers
Common questions
Use these answers when planning demos, pilots and production rollout.
Is a test-signed file invalid?
Not necessarily. Its signature can validate while its chain remains unrecognized, leading to Signed but untrusted.
Can we use private certificates internally?
Yes, with an explicit private trust policy. Make the scope clear and do not describe it as public ecosystem trust.
Does ProvSeal issue trusted certificates?
No. ProvSeal can support signing and verification workflows, but certificate issuance and public recognition depend on the applicable trust ecosystem.