Prove it existed, and keep it valid long after the certificate expires
A C2PA conformant timestamp cryptographically anchors the moment of signing, independently of the certificate’s lifecycle. Your content’s provenance stays verifiable long term.
Trusted, independent proof that a C2PA manifest existed at a moment in time
A Time Stamping Authority is a trusted third party that, on request, cryptographically signs the hash of your data together with the current time drawn from a trusted, audited time source. The result is a timestamp token that proves the data existed in exactly that form at that moment, and has not changed by a single bit since.
The client never sends the actual content. Only a hash (message digest) is transmitted, so the TSA never sees your data. Following RFC 3161, the requester submits a TimeStampReq containing the message imprint, and the TSA returns a signed TimeStampToken that can be verified independently and audited at any future date.
In C2PA, this matters because manifests without a trusted timestamp cease to be valid the moment the signing credential expires or is revoked. With a timestamp embedded as a countersignature, a validator can confirm the claim was signed while the credential was valid, and continue to trust it indefinitely.
Key benefits
Long-term validation (LTV)
A trusted timestamp lets a C2PA claim signature remain valid indefinitely, even after the signing certificate expires or is revoked. Essential for C2PA manifests intended to last.
C2PA-conformant
If you want C2PA validators to validate your timestamps, you need a C2PA Time Stamping Authority accredited on the C2PA TSA Trust List. SSL.com was the first WebTrust-audited CA to be added to the Trust List.
Your data never leaves your environment
Only the hash is sent. The TSA timestamps the message imprint and never sees the underlying content.
Trusted, audited time source
Time is drawn from a trusted source and signed with keys held in HSMs under SSL.com’s audited operations.
API-driven and scalable
High-volume RFC 3161 API for automated C2PA signing pipelines, from a handful of assets to billions.
SSL.com’s Time Stamping Authority is used by…
C2PA claim generators and platforms
Embedding trusted timestamps so Content Credentials survive certificate expiry.
Camera and device manufacturers
Attaching proof-of-existence at capture, or shortly after, server or app side.
Content creators and AI media platforms
Timestamping generated content to keep provenance verifiable long term.
C2PA conformant products
Needing trusted timestamps for long-term manifest validation.
Access and pricing
Choose how you consume the TSA.
C2PA Free Tier Certificate
2,500 timestamps per year included with a free tier C2PA certificate. On-demand or bulk rate for additional timestamps.
Apply for the free tierC2PA Premium Tier Certificate
10,000 timestamps per year included with a premium tier C2PA certificate. On-demand or bulk rate for additional timestamps.
Buy a premium tier C2PA certificateLarge-scale bulk rates
Buy as many timestamps as needed at a reduced large-scale bulk rate.
Contact sales- Secure, authenticated API access
- Questions? Chat with a content authenticity expert
- Need high-volume or enterprise pricing? Request a quote
How it works
1. Hash your data
Your C2PA claim generator computes the COSE ToBeSigned value with the CounterSignature context.
2. Request a timestamp
Your client sends an RFC 3161 TimeStampReq to the SSL.com TSA endpoint (RSA or ECC). Only the hash is transmitted.
3. TSA signs the time
SSL.com binds your hash to a trusted time value and signs it with an HSM-protected key, returning a TimeStampToken.
4. Embed the token
Embed the timestamp into the C2PA claim signature (for example with C2PA-RS) as a countersignature in the COSE_Sign1 structure.
5. Validate indefinitely
Any conformant C2PA validator can verify the timestamp against SSL.com’s trusted TSA certificate, proving the claim was signed while the credential was valid, now and in the future.
API endpoint
| Endpoint | API key | Description |
|---|---|---|
https://ts-c2pa.ssl.com | Required | C2PA-compliant RFC 3161 Time Stamping Authority API with ECC (RSA available on request) |
Compliance and standards
| Standard | Relevance |
|---|---|
| RFC 3161 (Time-Stamp Protocol) | Our TSA conforms to the IETF X.509 Time-Stamp Protocol covering the request/response format and TSA operational requirements. |
| C2PA Conformant TSA | SSL.com is accredited on the C2PA TSA Trust List. |
| RFC 5816 | ESSCertIDv2 update to the signing-certificate attribute used in timestamp tokens. |
| C2PA countersignature requirements | Timestamps are obtained per the C2PA additional requirements, using the CounterSignature context and COSE Sig_structure for the message imprint. |
| RFC 8152 (COSE) | The ToBeSigned value timestamped for C2PA is constructed per the COSE Sig_structure. |
| WebTrust for CA (BDO) | SSL.com’s CA and TSA operations are audited annually under WebTrust programs. |
Frequently asked questions
Without a trusted timestamp, a manifest stops being valid as soon as the signing certificate expires or is revoked. A timestamp lets a validator confirm the claim was signed while the credential was valid, so the manifest can be validated indefinitely.
It’s a special C2PA manifest that provides proof-of-existence for an asset and its manifest at a trusted time. It’s most often used when an earlier generator signed offline and couldn’t obtain a timestamp at signing time.
No. Only a hash (message imprint) is sent to the TSA. The actual content never leaves your environment.
Match the endpoint to your C2PA signing workflow and the algorithms your validators expect. Both are C2PA-compliant; ECC produces smaller tokens and is faster, RSA is available on request.
Our C2PA free tier includes 2,500 timestamps per year, with on-demand pricing for additional volume. Our C2PA Premium Tier includes 10,000 timestamps per year. Premium customers can buy additional volume at a reduced bulk rate.
Related products
C2PA Claim Signing Certificates (free and premium)
The signing certificate whose claim signatures you timestamp for long-term validation.
See C2PA certificates