C2PA Certificate Authority — Signing, Identity, Timestamps

Name: C2PA Certificate Authority — Content Credentials | Trufo
Brand: Trufo

Updated August 10, 2026

A trusted certificate is required for C2PA and CAWG provenance. Trufo is a recognized Certificate Authority (CA) on the C2PA and IPTC Trust Lists, chosen by industry leaders such as OpenAI and the IPTC. Trufo issues C2PA signing certificates for Generator Products, CAWG identity credentials for authorship attribution, and trusted RFC 3161 timestamping for long-term validation — for both small and large, hardware and software. Start free with test certificates; production starts at $600/year with by far the best developer experience.

Implementation Guide

Purchase a Certificate ↗

Products

C2PA focuses on technical data derived from software and hardware; CAWG focuses on publisher data derived from individuals and organizations. Both are built on a chain of trust, anchored by certificates from a trusted CA.

Trufo provides a full range of CA services for the content provenance ecosystem. According to customers, Trufo provides by far the best developer experience, with an ergonomic UI/UX Dashboard alongside a mature API and SDK setup. The certificate costs $600, but you will save far more than that in time and energy on Trufo’s platform.

C2PA Signing Certificates

C2PA Claim Signing Certificates for Generator Products: Level 1 is the recommended starting point, while Level 2 conveys hardware-level trust. To obtain a certificate, your Generator Product must have passed conformance with the C2PA. If you are still in the approval process, you can use our test certificate or contact Trufo for guidance. Trufo supports backend, edge, and distributed architectures. OV and PV are required. Enrollment uses EST (RFC 7030). OCSP stapling is included. Get a C2PA Certificate.

CAWG Identity Credentials

CAWG Identity Certificates for Branding & Attribution: CAWG is currently in an interim phase (much like C2PA was in 2025) while the trust model is being designed by industry experts. Trufo issues CAWG Interim certificates for organizations. OV is required. Get a CAWG Identity.

RFC 3161 Timestamps

C2PA-Trusted Timestamps for Generator Products: for long-term validation (over one year), a trusted timestamp (RFC 3161) is required. Trufo is a trusted TSA operator for C2PA, and offers prices that scale well with content volume.

The C2PA trust model is now live on v0.2, and C2PA v2.4 is now supported. If you would rather not build and maintain your own Generator Product, the Trufo Signing API can handle C2PA manifests for you.

Our CP/CPS can be found here, and additional certificate-related resources can be found in the TCA repository.

Start Building for Free

Trufo provides test certificates for free. You can use these to kickstart product development before committing to a full buildout. These are especially useful for generating sample files in any Conformance Application. Detailed instructions are on the Trufo Dashboard, but a quick way to start (with C2PA) is to run the following:

from trufo import generate_keypair, request_c2pa_test_cert
from trufo.crypt.algorithms import SigningAlgorithm

private_pem, _ = generate_keypair(SigningAlgorithm.ES256)

cert_chain_pem = request_c2pa_test_cert(
    org_name="My Company",
    common_name="My App",
    private_key_signer=private_pem,
)

Note that the test certificates are issued by a separate Trufo Issuing CA for testing, so Validators will not mark the test certificates as trusted.

Once you know what you want to build and are ready to go live, you can switch to the production certificate. See the C2PA certificates quickstart for the full walkthrough.

Pricing & Packages

C2PA Claim Signing certificates start at $600/year; CAWG Identity credentials start at $60/year.

Product	What It Includes	Starting At
C2PA Claim Signing	Full API/SDK suite, technical support, organization validation, OCSP responses, and unlimited reissuances.	$600/year
CAWG Identity	Branding & attribution for individuals and organizations.	$60-$600/year
RFC 3161 Timestamping	C2PA-trusted timestamps for Generator Products.	~$1,200/year for first 1M
Enterprise Packages	Custom contracts, including dedicated API endpoints with enterprise SLAs, such as 100+ RPS or multi-region deployments.	$20,000/year

For more pricing details, please create an account on the Trufo Dashboard (takes 30 seconds) and visit the C2PA Certificates page. For most companies, the self-serve products listed on the Trufo Dashboard should be sufficient; for custom enterprise packages, please schedule a consultation.

Frequently Asked Questions

Why do I need a certificate?

Both the C2PA and CAWG standards exist to assert provable data, i.e. digital provenance, about content.

C2PA focuses on technical data derived from software and hardware.
CAWG focuses on publisher data derived from individuals and organizations.
See 102: Provenance Standards for more information.

This provenance is built on a chain of trust. To manage this, the industry relies on a Public Key Infrastructure (PKI) — much like how HTTPS established trust for the secure web. See 105: Trust Infrastructure for more information.

For the ecosystem, this ensures content is credible and valuable. For implementers, however, it introduces strict requirements: (1) passing conformance checks for your C2PA Generator Products, and (2) obtaining trusted certificates from an authorized CA.

Do I need both a C2PA Certificate and a CAWG Certificate?

If you are building a Generator Product, you will need a C2PA Certificate. In most cases, you will want to provide CAWG Certificates to your users (via reselling). If you are using the Trufo C2PA Signing API, you will (as of July 2026) need a CAWG Certificate for your organization.

What information do I need to complete validation?

Both OV (Organization Validation) and PV (Product Validation) are required. For OV, you will need to provide enough information for us to call you using a publicly-registered phone number. For PV, you will need to provide evidence of C2PA conformance status.

How does certificate renewal work?

You can simply request a new certificate.

Where can I find the CP/CPS and other CA documents?

Our CP/CPS can be found here and additional certificate-related resources can be found in the TCA repository here.

Get Started with Trufo

Creating an account takes 30 seconds; all pricing and procurement details are on the dashboard.