|
| 1 | +--- |
| 2 | +title: C2PA conformance program |
| 3 | +--- |
| 4 | + |
| 5 | +The [C2PA conformance program](https://c2pa.org/conformance) was launched in mid-2025 to help ensure that products that read and create Content Credentials are compliant with the C2PA Content Credentials specification. |
| 6 | + |
| 7 | +The C2PA conformance program covers: |
| 8 | + |
| 9 | +- [Validator products](#validator-products) that read and validate Content Credentials. |
| 10 | +- [Generator products](#generator-products) that create Content Credentials and add them to a digital asset. |
| 11 | +- [Certificate authorities (CAs)](#certificate-authorities). |
| 12 | + |
| 13 | +:::info |
| 14 | +If you're developing a product that reads or creates Content Credentials, you can apply for the C2PA conformance program. If accepted, the product is added to the [conforming products list](https://github.com/c2pa-org/conformance-public/blob/main/conforming-products/conforming-products-list.json), which indicates it is compliant with the C2PA Content Credentials specification. |
| 15 | + |
| 16 | +**To start the process, fill out C2PA's [expression of interest form](https://docs.google.com/forms/d/e/1FAIpQLScERZH5rKfoeSu3y6gGbkllkyeAhmF0G-kXS0eXpb2vR238Rg/viewform).** |
| 17 | +::: |
| 18 | + |
| 19 | +When you apply to the conformance program, you will: |
| 20 | + |
| 21 | +- Sign a legal agreement with the C2PA. |
| 22 | +- Provide evidence supporting your application such as diagrams and documentation. |
| 23 | +- Work with the conformance program staff to resolve any questions. |
| 24 | + |
| 25 | +:::tip |
| 26 | +Use the [**Conformance Explorer**](https://spec.c2pa.org/conformance-explorer/) to browse and search live versions of the C2PA [Conforming Products List](#products) and [trust lists](#c2pa-trust-lists). |
| 27 | +::: |
| 28 | + |
| 29 | +## Products |
| 30 | + |
| 31 | +### Validator products |
| 32 | + |
| 33 | +A _validator product_ can read and validate a manifest store for a digital asset. |
| 34 | +A conforming validator product produces correct validation results according to the C2PA Content Credentials specification. |
| 35 | + |
| 36 | +For more information, see [C2PA Conformance Program Documents](https://github.com/c2pa-org/conformance-public/tree/main/docs/current), specifically |
| 37 | +[C2PA conformance program - section 6.1.1, Validator Product Specification Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Conformance%20Program.pdf). |
| 38 | + |
| 39 | +### Generator products |
| 40 | + |
| 41 | +A _generator product_ can generate manifest data for a digital asset. A conforming generator product produces manifest data that conforms to the C2PA Content Credentials specification, creates assertions in the asset's active manifest and signs a claim using a valid X.509 certificate on the C2PA trust list. |
| 42 | + |
| 43 | +For more information, see [C2PA Conformance Program Documents](https://github.com/c2pa-org/conformance-public/tree/main/docs/current), specifically: |
| 44 | + |
| 45 | +- [C2PA conformance program - section 6.1.1, Generator Product Specification Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Conformance%20Program.pdf) |
| 46 | +- [C2PA Generator Product Security |
| 47 | + Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Generator%20Product%20Security%20Requirements.pdf) |
| 48 | + |
| 49 | +#### Preliminary certificate check |
| 50 | + |
| 51 | +To confirm all the settings in your signing certificate, you can follow the [preliminary certificate check](conformance/itl.mdx#checking-your-certificate) for the interim trust list to help ensure everything is as expected. |
| 52 | + |
| 53 | +#### Security requirements |
| 54 | + |
| 55 | +When you apply to the conformance program, you must fill out the information required in the **product security architecture template** in Appendix C of the [C2PA Generator Product Security |
| 56 | +Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Generator%20Product%20Security%20Requirements.pdf), providing details on: |
| 57 | + |
| 58 | +- The organization submitting the application. |
| 59 | +- The product, its capabilities, and the systems it uses or relies upon. |
| 60 | +- The product's security architecture, including methods for key generation and storage, and protections against various kinds of misconfiguration, abuse, and exploitations. |
| 61 | + |
| 62 | +### Assurance levels |
| 63 | + |
| 64 | +A conforming product's _assurance level_ indicates the level of confidence that claims it signs reflect its intended behavior. A higher assurance level indicates a greater level of confidence. Currently, the conformance program has two assurance levels: level 1 and level 2: |
| 65 | + |
| 66 | +- [C2PA Generator Product Security |
| 67 | + Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Generator%20Product%20Security%20Requirements.pdf) details the security requirements for each assurance level. |
| 68 | +- [C2PA certificate policy - Appendix A](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Certificate%20Policy.pdf) details the requirements for claim signing certificates for each assurance level. |
| 69 | + |
| 70 | +The assurance level is encoded as the value of a custom X.509 v3 certificate extension in the product's claim signing certificate. The C2PA defines the _max assurance level_ of a generator product based on the security attributes of its overall implementation architecture. The assurance level in the certificate issued to a particular instance of a conforming generator product may be lower than the max assurance level. |
| 71 | + |
| 72 | +## Certificate authorities |
| 73 | + |
| 74 | +The [C2PA certificate policy](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Certificate%20Policy.pdf) specifies requirements for certificate authorities (CAs) that issue claim signing certificates for use by generator products, and the requirements that those products have to meet when using the certificates. |
| 75 | + |
| 76 | +CAs that meet the certificate policy can be on the C2PA trust list, and can issue certificates to conforming generator products under the C2PA conformance program. |
| 77 | + |
| 78 | +## Checking your certificate |
| 79 | + |
| 80 | +Before requesting to [add your signing certificate to the interim known certificate list](#how-to-add-a-certificate-to-the-list), perform a preliminary check to ensure the certificate is configured properly. |
| 81 | + |
| 82 | +### Prerequisites |
| 83 | + |
| 84 | +The preliminary certificate check procedure below requires the following tools. You must install them if you haven't done so already: |
| 85 | + |
| 86 | +- [jq](https://jqlang.org/), a lightweight and flexible command-line JSON processor. On macOS, if you have [Homebrew](https://brew.sh/), you can install jq by entering `brew install jq`. |
| 87 | +- [OpenSSL](https://www.openssl.org/), a cryptographic software library and CLI. It's installed on many systems such as macOS (but make sure you have a recent version). If OpenSSL is not installed on your system, see the [list of unofficial binary distributions](https://wiki.openssl.org/index.php/Binaries). |
| 88 | +- [C2PA Tool](c2patool/readme.md), the command line tool for working with C2PA manifests and media assets. |
| 89 | + |
| 90 | +### Procedure |
| 91 | + |
| 92 | +:::note |
| 93 | +In the example commands given below, `cert.pem` is your certificate file. |
| 94 | +::: |
| 95 | + |
| 96 | +Check your certificate by following these steps: |
| 97 | + |
| 98 | +1. **Ensure that signing with the certificate doesn't have any validation errors** by using a C2PA Tool command like this: |
| 99 | + |
| 100 | + ``` |
| 101 | + c2patool ./image.jpg trust --allowed_list ./cert.pem |
| 102 | + ``` |
| 103 | + |
| 104 | + Confirm that the result does not contain a `validation_status` field, which indicates an error. |
| 105 | + |
| 106 | +1. **Confirm that the `signature_info.issuer` field in the manifest is correct**. This field determines what [Verify displays for the organization name](verify.mdx#title-and-signing-information) after "Issued by ...". Use a C2PA Tool command like this: |
| 107 | + |
| 108 | + ``` |
| 109 | + c2patool ./image.jpg trust --allowed_list ./cert.pem \ |
| 110 | + | jq --args '.manifests[].signature_info.issuer' |
| 111 | + ``` |
| 112 | + |
| 113 | + The response should be something like this: |
| 114 | + |
| 115 | + ``` |
| 116 | + "XYZ Inc." |
| 117 | + ``` |
| 118 | + |
| 119 | + Where "XYZ Inc." is the name of your organization. |
| 120 | + |
| 121 | +1. **Use `openssl` to perform basic verification of the certificate** you're submitting; for example: |
| 122 | + |
| 123 | + ``` |
| 124 | + openssl x509 -noout -text -in 'cert.pem' | grep 'Subject:' |
| 125 | + ``` |
| 126 | + |
| 127 | + Example response: |
| 128 | + |
| 129 | + ``` |
| 130 | + Subject: organizationIdentifier=XYZ-7155227, C=US, ST=Delaware, L=Dover, O=Whatever Inc., SN=xxx, GN=xxx, CN=xxx |
| 131 | + ``` |
| 132 | + |
| 133 | +## Using the interim known certificate list |
| 134 | + |
| 135 | +You can use the C2PA Tool or the CAI JavaScript library to determine whether a certificate is on the interim known certificate list. |
| 136 | + |
| 137 | +### Using with C2PA Tool |
| 138 | + |
| 139 | +The [C2PA Tool documentation](c2patool/docs/usage.md#configuring-trust-support) explains how to use the interim known certificate list with the tool. |
| 140 | + |
| 141 | +### Using with the JavaScript library |
| 142 | + |
| 143 | +To load and use these lists with the JavaScript library (`c2pa-js`), pass them to the `read` function as shown in the following TypeScript example: |
| 144 | + |
| 145 | +```ts |
| 146 | +import { createC2pa, type ToolkitSettings } from 'c2pa'; |
| 147 | +import wasmSrc from 'c2pa/dist/assets/wasm/toolkit_bg.wasm?url'; |
| 148 | +import workerSrc from 'c2pa/dist/c2pa.worker.min.js?url'; |
| 149 | + |
| 150 | +async function loadTrustResource(file: string): Promise<string> { |
| 151 | + const res = await fetch(`https://contentcredentials.org/trust/${file}`); |
| 152 | + |
| 153 | + return res.text(); |
| 154 | +} |
| 155 | + |
| 156 | +async function getToolkitSettings(): Promise<ToolkitSettings> { |
| 157 | + const [trustAnchors, allowedList, trustConfig] = await Promise.all( |
| 158 | + ['anchors.pem', 'allowed.sha256.txt', 'store.cfg'].map(loadTrustResource), |
| 159 | + ); |
| 160 | + |
| 161 | + return { |
| 162 | + trust: { |
| 163 | + trustConfig, |
| 164 | + trustAnchors, |
| 165 | + allowedList, |
| 166 | + }, |
| 167 | + verify: { |
| 168 | + verifyTrust: true, |
| 169 | + }, |
| 170 | + }; |
| 171 | +} |
| 172 | + |
| 173 | +async function readFile(asset: File) { |
| 174 | + const c2pa = await createC2pa({ |
| 175 | + wasmSrc, |
| 176 | + workerSrc, |
| 177 | + }); |
| 178 | + |
| 179 | + return c2pa.read(asset, { |
| 180 | + settings: await getToolkitSettings(), |
| 181 | + }); |
| 182 | +} |
| 183 | +``` |
| 184 | + |
| 185 | +:::note |
| 186 | +This code is for illustration purposes only. To ensure acceptable performance, production code should reuse the `c2pa` object and cache the output of `getToolkitSettings()` to avoid making unnecessary network calls. |
| 187 | +::: |
| 188 | + |
| 189 | +## How to add a certificate to the list |
| 190 | + |
| 191 | +If you have an application that is in production and publicly available, you can request to add its signing certificate to the interim known certificate list. |
| 192 | + |
| 193 | +:::warning Warning |
| 194 | +The interim trust list is being deprecated. While you can still request to add your certificate to the list (through the end of 2025), you are strongly encouraged to apply to the C2PA conformance program and use the official C2PA trust list. See [C2PA conformance program](conformance/index.mdx) for more information. |
| 195 | +::: |
| 196 | + |
| 197 | +Follow these steps: |
| 198 | + |
| 199 | +1. [**Do a preliminary check of your certificate**](#checking-your-certificate) to ensure it meets the requirements for C2PA signing certificates and to be in the Verify interim certificate list. |
| 200 | +1. **Submit your request ** by emailing `[email protected]`. We will review your request, and if it is approved, we'll ask for more details. Once we receive them and deploy the update to the trust list, you will receive a confirmation email. |
0 commit comments