Trufo is a recognized Certificate Authority (CA) on the C2PA and IPTC Trust Lists, chosen by industry leaders such as OpenAI and the IPTC. Trufo issues C2PA signing certificates for Generator Products, CAWG identity credentials for authorship attribution, and trusted RFC 3161 timestamping for long-term validation — for both small and large, hardware and software. Start free with test certificates; production starts at $40–50/mo (first month free) with a self-serve dashboard and open-source Python SDK.
Trufo is a trusted Certificate Authority for content provenance, and is on:
C2PA focuses on technical data derived from software and hardware; CAWG focuses on publisher data derived from individuals and organizations. Both are built on a chain of trust, anchored by certificates from a trusted CA.
Trufo provides a full range of CA services for the content provenance ecosystem. According to customers, Trufo provides by far the best developer experience, with an ergonomic UI/UX Dashboard alongside a mature API and SDK setup. The certificate costs $40–50/mo, but you will save far more than that in time and energy on Trufo’s platform.
C2PA Claim Signing Certificates for Generator Products: Level 1 is the recommended starting point, while Level 2 conveys hardware-level trust. To obtain a certificate, your Generator Product must have passed conformance with the C2PA. If you are still in the approval process, you can use a test or dummy certificate (see below) or contact Trufo for guidance. Trufo supports backend, edge, and distributed architectures. OV and PV are required. Enrollment uses EST (RFC 7030). OCSP stapling is included. Get a C2PA Certificate.
CAWG Identity Certificates for Branding & Attribution: CAWG is currently in an interim phase (much like C2PA was in 2025) while the trust model is being designed by industry experts. Trufo issues CAWG Interim certificates for organizations. OV is required. Get a CAWG Identity.
C2PA-Trusted Timestamps for Generator Products: for long-term validation (over one year), a trusted timestamp (RFC 3161) is required. Trufo is a trusted TSA operator for C2PA, and offers prices that scale well with content volume.
The C2PA trust model is now live on v0.2, and C2PA v2.4 is now supported. If you would rather not build and maintain your own Generator Product, the Trufo Signing API can handle C2PA manifests for you.
Our CP/CPS can be found here, and additional certificate-related resources can be found in the TCA repository.
Trufo provides test certificates for free. The test flow runs the whole production flow on Trufo’s test hosts before you buy; you need a Trufo account, and the steps are in the certificates docs.
For generating sample files in any Conformance Application, a dummy certificate needs no account; a quick way to get one (with C2PA) is to run the following:
from trufo import generate_keypair, request_c2pa_dummy_cert
from trufo.crypt.algorithms import SigningAlgorithm
private_pem, _ = generate_keypair(SigningAlgorithm.ES256)
cert_chain_pem = request_c2pa_dummy_cert(
org_name="My Company",
common_name="My App",
private_key_signer=private_pem,
country="US",
)Note that test and dummy certificates are issued by a separate Trufo Issuing CA for testing, so Validators will not mark them as trusted.
Once you know what you want to build and are ready to go live, you can switch to the production certificate. See the C2PA certificates quickstart for the full walkthrough.
Level 1 C2PA Claim Signing certificates are $40–50/mo; CAWG Organization certificates start at $25/mo. The first month of every self-serve plan is free.
| Product | What It Includes | Starting At |
|---|---|---|
| C2PA Claim Signing | Full API/SDK suite, technical support, organization validation, OCSP responses, and unlimited reissuances. | $40–50/mo |
| CAWG Identity | Branding & attribution for individuals and organizations. | from $25/mo |
| RFC 3161 Timestamping | C2PA-trusted timestamps for Generator Products. | $18/mo + scaling costs (~$2,000/year for first 1M) |
| Enterprise Packages | Custom contracts, including dedicated API endpoints with enterprise SLAs, such as 100+ RPS or multi-region deployments. | $20,000/year |
For more pricing details, please create an account on the Trufo Dashboard (takes 30 seconds) and visit the C2PA Certificates page. For most companies, the self-serve products listed on the Trufo Dashboard should be sufficient; for custom enterprise packages, please schedule a consultation.
Both the C2PA and CAWG standards exist to assert provable data, i.e. digital provenance, about content.
This provenance is built on a chain of trust. To manage this, the industry relies on a Public Key Infrastructure (PKI) — much like how HTTPS established trust for the secure web. See 105: Trust Infrastructure for more information.
For the ecosystem, this ensures content is credible and valuable. For implementers, however, it introduces strict requirements: (1) passing conformance checks for your C2PA Generator Products, and (2) obtaining trusted certificates from an authorized CA.