How to Get Started with C2PA Content Credentials
Abstract: This guide covers how C2PA Content Credentials work, the certificate types available through SSL, the two assurance levels that determine which certificate fits your use case, and the step-by-step process for obtaining a certificate. SSL was among the first publicly trusted CAs on the C2PA Trust List and has been issuing production-ready C2PA certificates since 2025, making it the most established partner for organizations ready to immediately build content authenticity into their workflows.
AI-generated images, deepfake videos, and doctored audio are flooding the internet at an unprecedented scale. Fabricated content that looks authentic is becoming frighteningly sophisticated and much harder to detect with the naked eye. If your customers are spoofed by media that appears to be legitimate communication from your organization, the negative impact on your brand, reputation, and bottom line can be significant. So how do you prove that your published content is real and actually came from you?
C2PA Content Credentials directly address this challenge, providing solutions for content authenticity.
Explore Content Authenticity Solutions
What Is C2PA and How Does It Work?
C2PA stands for Coalition for Content Provenance and Authenticity. Content Credentials act like the “nutritional label” for digital media. Just as food packaging tells you what’s inside and where it came from, C2PA Content Credentials provide details about the origin of a digital asset, who created or changed it, and whether it has been altered. They are pieces of metadata, or extra information, embedded in digital files to show their history.
When content is created or edited, a manifest (a structured block of metadata) gets embedded directly into the asset. That manifest captures the provenance chain: who made it, which tools were used, and when each action occurred. The manifest is then cryptographically signed, meaning any unauthorized alteration of the manifest breaks the signature and triggers a warning during verification. So, if your brand assets, product imagery, or media are ever impersonated or manipulated, Content Credentials give your organization a clear, defensible record of exactly what you produced and when.
C2PA is broadly adopted in digital media, supporting images, video, audio, documents, and text. Major device manufacturers, AI platforms, and media tools have integrated it, such as Adobe Photoshop, ChatGPT, Google Gemini, Leica, Nikon, Canon, Samsung, and Google’s Pixel line. Validators like LinkedIn, TikTok, Microsoft, and Google surface Content Credentials to end users.
Adoption is accelerating rapidly. Organizations that establish content authenticity workflows now gain a critical advantage, as content authenticity is poised to become an urgent, baseline expectation. Delaying implementation could leave your organization behind as standards evolve and risks intensify.
Two Standards, Two Purposes
Implementing Content Credentials requires understanding two complementary certificate types, each serving a distinct function.
C2PA Claim Signing Certificates are issued to software tools, platforms, and devices. If your organization provides a content management system, a media publishing platform, digital cameras, recording devices, mobile phones, or a GenAI tool, this is the certificate that embeds provenance data into your assets at the point of creation or processing. One certificate is issued per generator product, and it must come from a Certificate Authority (CA) listed on the C2PA Trust List. SSL was among the first of those CAs.
CAWG Certificates (Creator Assertions Working Group) serve a different purpose: individual and organizational attribution. CAWG certificates allow a person or company to add an additional verified signature to an asset. This is the layer that says “I created this” or “my organization is responsible for this content” in a cryptographically verifiable way. For brands protecting their visual identity, journalists asserting authorship, or organizations signing off on approved media, CAWG is the identity layer that C2PA alone cannot provide.
Together, these two certificate types create a complete picture: what was used to create or modify an asset, and who is accountable for it.
The Three Pillars of Durable Content Credentials
Content Credential durability relies on three foundations:
C2PA Manifests capture provenance at the moment of creation or modification and travel with the asset.
Digital Signatures cryptographically bind the manifest to a trusted identity. This is where certificates come in. Only signing certificates issued by a C2PA Trust List Certificate Authority allow verification of those signatures. SSL is the first publicly trusted CA on the C2PA conformance list, issuing production certificates since early 2025.
Digital Watermarks serve as a recovery mechanism. If a manifest is stripped from an asset, an imperceptible watermark embedded in the content itself can restore it. This makes Content Credentials significantly more resilient against bad actors who try to scrub provenance data.
Certificate Types: What You Need and Why
SSL offers a full suite of C2PA-compliant certificates to cover every use case in a content authenticity workflow.
Before picking a certificate type, it’s important to know the two ‘assurance levels’ that the C2PA system defines. Assurance levels are categories that describe how much trust you can place in the claims made in a manifest, based on the security level of the system used to sign the data.
Assurance Level 1 covers software-based signing. This applies to editing tools, cloud services, AI platforms, and app-based workflows. The signing key lives in software, which makes Level 1 easier to integrate and scale, but also reflects a lower overall trust floor than hardware-backed implementations.
Assurance Level 2 requires hardware-backed signing. The private key is protected by dedicated hardware (such as a secure element or HSM), making it significantly harder to compromise. Level 2 is the right choice for physical capture devices (digital cameras, cam recorders, mobile phones, microphones, etc.) and any workflow where the integrity of the original capture moment is the primary concern.
Knowing which level your product falls under determines which certificate you need:
- C2PA Platform Certificates are for software-based generators, such as editing tools, cloud platforms, AI services, and app pipelines. One certificate covers one generator product. These certificates align with Assurance Level 1.
- C2PA Device Certificates are for hardware generators, such as cameras, smartphones, camcorders, microphones, and capture devices. These align with Assurance Level 2, and SSL delivers them through a high-availability API.
- CAWG Certificates serve an important complementary role. Where C2PA certificates authenticate tools and devices, CAWG Certificates authenticate the people and organizations behind the content. Based on SSL’s S/MIME standard and issued by public CAs, CAWG certificates let individual journalists, photographers, or media organizations add a verified creator assertion directly to their content.
- The C2PA Time Stamping Service is crucial but often overlooked. ‘Time stamping’ means adding a trusted record of the exact time content was signed, using a service that complies with RFC 3161 (an international standard for digital time stamps). Without this, content can only be trusted as long as the signing certificate is valid. If a certificate expires or is revoked, it’s impossible to prove when the content was signed. SSL’s Time Stamping Authority (TSA) records and protects the signing time, so your content’s authenticity can be verified even if certificates change or expire later.
- C2PA Claim Signing API is our SaaS option to create, edit, and sign C2PA manifests for your assets through a simple API call, making Content Credential workflows accessible to teams without deep C2PA or PKI infrastructure: we take care of both for you.
The Signing Workflow
The path from content creation to signed, verifiable output involves two categories of participants.
Generators are the tools and devices that create C2PA claims and sign them. When a photographer captures an image on a C2PA-enabled camera or a creative team exports a video from a compliant editing platform, the generator automatically builds the manifest and applies the digital signature using its C2PA certificate.
Validators are the tools and platforms that read and verify those claims for end users. Verification checks the cryptographic signature, confirms the certificate against the C2PA Trust List, and presents the result in a human-readable summary. Anyone can verify content today at verify.contentauthenticity.org or on LinkedIn, and major platforms are actively building these checks into their own interfaces. For instance, Google has announced that Chrome will soon natively support validation.
To obtain a C2PA Platform or Device Certificate from SSL, generator products must first complete the C2PA Conformance Program. The process involves an expression of interest, an intake form, architecture and interoperability testing, and receipt of a Conformance Letter from the C2PA. SSL can support organizations through the security architecture documentation requirements. If you are a SSL customer, we can help you streamline this process by providing our security architecture template and documentation.
Once your product holds a Conformance Letter, the SSL certificate issuance process follows three clear steps.
Step 1: Submit Your CSR and Conformance Letter. You provide SSL with the Conformance Letter received from the C2PA program, the Certificate Signing Request (CSR) file for your certificate, and your SSL account ID.
Step 2: Validation. SSL authenticates the certificate requester and verifies all requirements. This includes creating an account on SSL’s portal, completing SSL’s AI-based identity verification to obtain Individual Validation approval, and a review by SSL’s validation team to confirm all requirements are met.
Step 3: Certificate Delivery. Once SSL confirms the CSR and completes validation, they generate your certificate and deliver it directly through your SSL account. Alternatively, validation and delivery can also happen through our API.
The process is designed to be thorough without slowing down your operations. SSL’s team works alongside customers throughout, and enterprise customers receive a dedicated technical account manager and executive sponsor to guide onboarding.
Why Choose SSL for C2PA
Not every Certificate Authority can issue C2PA certificates. To do so, a CA must pass the C2PA Conformance Program’s rigorous requirements and be listed on the official C2PA Trust List. SSL was the first publicly trusted CA to achieve conformant status and has been issuing production-ready C2PA certificates since 2025.
Additionally, the SSL team built a dedicated C2PA infrastructure and has remained actively involved in both the C2PA and CAWG working groups, chairing some of the workgroups and contributing to the specification development itself. When requirements evolve, SSL customers don’t have to scramble to catch up.
A few other reasons SSL stands out in the content authenticity space:
SSL operates as a top-five public CA by volume, routinely generating millions of certificates and signatures daily. The infrastructure supporting your C2PA certificates is the same infrastructure that handles some of the world’s highest-throughput PKI environments. Reliability and scalability are built in, not bolted on.
SSL also launched the first publicly available C2PA sandbox, providing developers and product teams with a place to test signing workflows with real certificates before committing. We also provide a free C2PA manifest verification platform that allows analyzing the signature and certificate details called C2PA.sh. That kind of hands-on access is rare in enterprise PKI, and it reflects SSL’s philosophy of making complex security technology approachable.
For enterprise customers, SSL provides a 99.9% target uptime SLA, 24×7 priority Tier 1 support, and dedicated elevated support on business days with 24×5 on-call access for critical issues. Response times for critical issues are measured in hours, not days.
Why Act Now
Waiting for wider adoption to justify investment in content authenticity is the wrong calculation. The brands and platforms that build C2PA workflows today will have verifiable content provenance when audiences, regulators, and content creators demand it as a baseline. Content without credentials will be presumed to be untrustworthy.
SSL brings the infrastructure, expertise, and Trust List standing to make that transition practical. If your organization creates, distributes, or publishes digital content at any meaningful scale, Content Credentials should be part of your security and brand trust strategy now. Contact us below to get started:
