C2PA Trust List Checker
Check a Content Credentials signing certificate against the C2PA trust list and C2PA’s certificate profile. See too whether it declares itself an EU qualified certificate.
Free and informational, not a qualified validation service under eIDAS. Each mode below states what happens to your input.
The certificate is sent to the Tessio verifier service and checked in memory. It is not stored.
What this checks
- Whether the certificate is on C2PA’s claim signer or timestamp authority list, or chains to an entry using the certificates you paste. The status shown is the least trusting one that applies to the certificate or to any listed certificate above it.
- For a claim signing leaf, each rule of C2PA’s certificate profile: extended key usage, key usage, policy, assurance level, validity, CPL record id and the rest.
- Whether the certificate is an EU qualified certificate for seals, signatures or websites: what it declares under ETSI EN 319 412-5, read with what its country’s EU trusted list grants its CA for.
- Not revocation, the Conforming Products List or what a trusted list says about the qualified device. The report lists what it did not check.
C2PA trust lists from c2pa-org/conformance-public, © Coalition for Content Provenance and Authenticity, licensed under CC BY 4.0, refreshed daily.
Frequently asked
What is the C2PA trust list?
The Coalition for Content Provenance and Authenticity publishes the certificates it trusts to sign Content Credentials, in two lists: claim signers and timestamp authorities. Validators use them to decide whether a manifest shows as trusted. The lists use the ETSI TS 119 602 List of Trusted Entities schema and are published as plain JSON in C2PA’s conformance repository, under CC BY 4.0.
Why do my Content Credentials show as untrusted?
Usually because the signing certificate does not chain to an entry on the claim signer list, or because it does not meet C2PA’s certificate profile, for example a missing claim signing extended key usage. Paste the signer certificate followed by its issuing CA and this tool shows both answers, rule by rule.
Is a C2PA signature an eIDAS qualified seal?
Only if the signing certificate is an EU qualified certificate for electronic seals and its key is in a qualified device. This tool decides whether the certificate is an EU qualified certificate and for which use, from its country’s EU trusted list and what it declares under ETSI EN 319 412-5, following ETSI TS 119 615 clause 4.4.4. It shows whether the certificate declares its key in a qualified device but does not apply what the list says about the device, so treat a positive answer as strong evidence, not a ruling. Being on the C2PA trust list says nothing about eIDAS qualification.
What does an empty status mean?
C2PA’s own schema allows each service the status trusted or untrusted. Some entries are published with an empty status instead. The tool reports that as it is rather than guessing, because validators may treat such an entry differently.
Why does the list overview say unsigned?
Because C2PA publishes these lists as plain JSON, unlike the EUDI wallet lists, which are signed JWTs. The tool fetches them over HTTPS from C2PA’s repository, so their integrity rests on that connection alone.