CAWG Identity Certificates

As of October 2026, the two major providers of CAWG interim certificates for organizations are Trufo and SSL.com. The steps are:

1. Make sure you understand C2PA. If you are using Trufo’s C2PA signing services, you can add your CAWG identity easily. However, most C2PA Generator Products do not support this sort of “plug-and-play” functionality with CAWG, so if you are not using Trufo for C2PA signing, you would need to create your own C2PA Generator Product to use your CAWG identity properly.
2. Create an account at app.trufo.ai. You will be asked to create or join an organization; you can always transfer ownership or switch organizations later. MFA is required for certificates.
3. Navigate to the CAWG Certificates page and purchase a CAWG certificate. You will be asked to complete the validation process, which typically requires a phone callback and general legal verification.
4. Request your certificates via the Trufo API, or start using your CAWG identity with Trufo’s signing services immediately.

from trufo import generate_keypair, request_cawg_interim_cert
from trufo.api.session import TrufoSession
from trufo.crypt.algorithms import SigningAlgorithm
from trufo.util.credentials import TrufoAPIKey, load_api_key

session = TrufoSession()
session.init_session(api_key=load_api_key(TrufoAPIKey.TRUFO_API))

leaf_private_pem, _ = generate_keypair(SigningAlgorithm.ES256)

cert_chain_pem = request_cawg_interim_cert(
    client=session,
    private_key_signer=leaf_private_pem,
    validity_days=366,
)

The current recommendation is that you should experiment with adding organizational CAWG to your C2PA implementations since it will be a key component of the ecosystem (many news media organizations plan to do so soon), but you should be aware that CAWG will likely not reach a “mature” state until Q1 2027.

From a technical standpoint, CAWG is a collection of special assertions within C2PA, alongside the standard C2PA assertions and custom-domain assertions. There are a number of CAWG assertions:

The main one, cawg.identity, carries a CAWG certificate (or other verifiable credential) to demonstrate identity, along with a digital signature that secures a chosen subset of the assertions in the C2PA manifest as being attested to by the CAWG identity holder. For example, a news photo signed with both C2PA and CAWG could carry the following information:

Just like a C2PA claim, under best practices the cawg.identity assertion will include a timestamp and an OCSP response. Various elements of ToIP’s TRQP (Trust Registry Query Protocol) may be used to establish further verifiable credentials associated with the identity, such as whether a publisher is an IPTC Verified News Publisher (though it is still TBD whether TRQP will be used for this specific credential).

1. October 18, 2026

   The initial draft of the CAWG Certificate Policy has been published at cawg.io/certificate-policy/1.0-draft. While many sections are still in development, the document suggests that CAWG will likely borrow the proven validation processes established by S/MIME (IV/OV/SV) and SSL (DV) certificates, but (like C2PA) will maintain a new governed trust list and a new EKU OID.

2. September 16, 2026

   The IPTC has published a first edition of its C2PA/CAWG implementation guide for news publishers. The news media industry has been a key driver and supporter of publisher identity through CAWG in C2PA, and the first production uses of publisher identity should appear early next year once CAWG and IPTC-VNP reach maturity.

3. December 15, 2025

   The CAWG interim trust model now includes the DocumentSigning, S/MIME-Mozilla and IPTC-VNP (Verified News Publisher) programs. Because CAWG will likely move to a new trust model in the near future, Trufo will continue issuing DocumentSigning certificates (and IPTC-VNP where appropriate). At that point (likely early Q1 of 2027), Trufo will migrate all existing CAWG customers to the mature CAWG certificates.