Issue C2PA claim signing certificates

Configure and issue C2PA claim signing certificates for compliant camera devices to embed trusted content provenance and authenticity information.

11 minute read

C2PA is an open technical standard for adding tamper-evident provenance metadata, known as Content Credentials, to digital assets such as images and videos. DigiCert Device Trust Manager supports issuing C2PA level 1 claim signing certificate, allowing manufacturers to integrate content credentials into camera and video devices.

For more information about C2PA requirements, account setup, and certificate issuance, see C2PA claim signing certificates.

What this tutorial covers

In this tutorial, you will:

Finish the required CertCentral setup for C2PA certificate issuance
Create a CertCentral API key
Create a CertCentral CA connector in Device Trust Manager
Create a C2PA certificate profile using the CertCentral CA connector
Create a certificate management policy that requires client-side key generation
Submit a CSR and request a C2PA claim signing certificate

What this tutorial does not cover

This tutorial does not explain how to:

Set up your account for C2PA
Add your generator product to the C2PA Conforming Products List
Finish C2PA organization validation
Have DigiCert provision the required certificate authorities
Add Content Credentials to media or validate signed media

Complete these requirements before using this API workflow. For instructions, see C2PA claim signing certificates.

Before you begin

Before you begin, make sure you have:

A DigiCert® ONE account with access to Device Trust Manager and CertCentral.

A CertCentral account that has finished the C2PA account setup, organization validation, registered-product setup, and CA provisioning requirements.

A Device Trust Manager API key (DEVCTM_SOLUTION_ADMINISTRATOR) with the Solution Administrator role.

Your DigiCert ONE account ID and the ID of the Device Trust Manager division where you will create the certificate profile and policy. For instructions on creating a division, see Step 1: Create a division under Register multiple devices.

A supported tool for generating and securely storing a private key and CSR. The C2PA Certificate Policy requires you to generate the private key and submit a CSR.

Endpoint overview

Method	Path	Description
GET	`/devicetrustmanager/api/v4/division`	Find the division ID
GET	`/devicetrustmanager/certificate-configuration-service/api/v1/ca-connector/{id}`	Verify the CertCentral CA connector
POST	`/devicetrustmanager/certificate-configuration-service/api/v1/certificate-profile`	Create the C2PA certificate profile
POST	`/devicetrustmanager/certificate-configuration-service/api/v2/certificate-policy`	Create the C2PA certificate management policy
POST	`/devicetrustmanager/certificate-issuance-service/api/v2/certificate`	Request a C2PA claim signing certificate

Reference values

Field	Value for this tutorial	Purpose
`ca_connector_type`	`digicert_cis`	Uses the CertCentral CA connector
`ca_connector_cert_profile`	`c2pa`	Selects the CertCentral C2PA product
`certificate_type`	`end_entity`	Creates an end-entity claim signing certificate profile
`certificate_management_methods`	`SINGLE`	Allows individual certificate requests through the REST API
`key_generation_option`	`client_side`	Requires the requester to generate and retain the private key
`server_side_key_gen`	`false`	Submits a CSR instead of requesting server-side key generation
`response_with_certificate_only`	`false`	Returns a JSON response
`split_certificate_response`	`true`	Returns the end-entity certificate separately from its chain
`include_certificate_chain`	`true`	Includes intermediate and root certificates in the response

Step 1: Set up CertCentral

Complete Step 1: Set up CertCentral under C2PA claim signing certificates before continuing with this tutorial.

During this setup, provide your organization details and select your registered generator product. The organization name in CertCentral must exactly match the organization name in the C2PA Conforming Products List.

Continue to Step 2: Create a CertCentral API key after DigiCert finishes the C2PA organization validation.

Step 2: Create a CertCentral API key

Create a CertCentral API key for the CA connector in Device Trust Manager.

Sign in to CertCentral.
In the left menu, go to Automation > API Keys.
Select Add API Key.
Provide a Description that identifies the key. For example, C2PA Connector Key.
In the User menu, link the API key to either a Service User or Users.
Leave the API key restrictions menu blank (None).
Select Add API Key.
In the New API Key window, copy the API Key.
Store it in a secure location.

The API keys are shown only once, do not leave this page until you have copied the API Key and stored it in a secure location.

After saving the API key (or keys), select I understand I will not see this again.

If you lose the API key, you can always create another API key.

You will use this key in Step 3: Create a CA connector for CertCentral.

Step 3: Create a CA connector for CertCentral

Create the CA connector through the Device Trust Manager portal.

Sign in to DigiCert ONE.
In the Managers menu, select Device Trust.
In the Device Trust Manager menu, go to Integrations > CA connectors.
Select Create CA connector.
Provide a Nickname that identifies the connector. For example, C2PA Connector.
Optionally, provide a description.
For CA source, select CertCentral API.
Enter the CertCentral API key you created in Step 2.
Select Create CA connector.

Device Trust Manager lists the connector under Integrations > CA connectors.

Note down the CA connector ID. You will use it in Step 5: Create a C2PA certificate profile.

Step 4: Verify the CertCentral CA connector

Retrieve the ID of the CertCentral CA connector created in Step 3. You will use this ID when creating the C2PA certificate profile.

Do not use a certificate template ID for this. The certificate profile request uses the CertCentral CA connector ID.

The CA connector ID resembles the following example:

82251327-6093-47e5-9e36-8e9264c5df9a

Request:

**Request**:

```bash
curl --request GET \
  --url 'https://demo.one.digicert.com/devicetrustmanager/certificate-configuration-service/api/v1/ca-connector/<CA_CONNECTOR_ID>' \
  --header 'Accept: application/json' \
  --header 'x-api-key: <DEVCTM_SOLUTION_ADMINISTRATOR_API_KEY>'

Set the path parameter:

CA_CONNECTOR_ID: ID of the CertCentral CA connector created in Step 3.

Successful response (200 OK):

{
  "id": "<CA_CONNECTOR_ID>",
  "account_id": "<ACCOUNT_ID>",
  "url": "https://www.digicert.com",
  "name": "C2PA Connector",
  "description": "C2PA Connector",
  "connector_type": "digicert_cis",
  "auth_type": "api_key",
  "status": "ACTIVE",
  "created_at": "2026-10-29T12:12:28Z"
}

Step 5: Create a C2PA certificate profile

Create a certificate profile that uses the CertCentral CA connector ID from Step 3: Create a CA connector for CertCentral. This certificate profile defines the CertCentral C2PA certificate product, validated organization, registered product, permitted signature algorithms, certificate validity period, renewal settings, and divisions that apply to C2PA claim signing certificate request.

Request:

curl --location 'https://demo.one.digicert.com/devicetrustmanager/certificate-configuration-service/api/v1/certificate-profile' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'x-api-key: DEVCTM_SOLUTION_ADMINISTRATOR_API_KEY' \
--data '{
    "account_id": "ID of the account the certificate profile belongs to (UUID)",
    "name": "C2PA Certificate Profile",
    "ca_connector_type": "digicert_cis",
    "ca_connector_id": "ID of the CA connector",
    "ca_connector_end_entity_profile": "",
    "ca_connector_cert_profile": "c2pa",
    "certcentral_container_id": <12345>,
    "ca_connector_name": "C2PA Connector",
    "ca_connector_status": "ACTIVE",
    "status": "ACTIVE",
    "divisions": [],
    "omit_primitive_encoding": false,
    "body": [
        {
            "key": "signature_algorithm",
            "optional": false,
            "enabled": true,
            "sources": [
                "fixed_value"
            ],
            "value": "sha256"
        },
        {
            "key": "subject.common_name",
            "optional": false,
            "enabled": true,
            "sources": [
                "user_supplied",
                "csr"
            ],
            "value": ""
        },
        {
            "key": "subject.organization_name",
            "optional": false,
            "enabled": true,
            "sources": [
                "user_supplied",
                "csr",
                "fixed_value"
            ],
            "value": "Unique value of the organization (12345)"
        },
        {
            "key": "subject.organization_unit",
            "optional": true,
            "enabled": false,
            "sources": [],
            "value": []
        },
        {
            "key": "san.dns_name",
            "optional": true,
            "enabled": false,
            "sources": [],
            "value": []
        },
        {
            "key": "san.email",
            "optional": true,
            "enabled": false,
            "sources": [],
            "value": []
        },
        {
            "key": "san.user_principal_name",
            "optional": true,
            "enabled": false,
            "sources": [],
            "value": []
        },
        {
            "key": "csr",
            "optional": false,
            "enabled": true,
            "sources": [
                "user_supplied"
            ],
            "value": null
        },
        {
            "key": "validity.duration_unit",
            "optional": false,
            "enabled": true,
            "sources": [
                "fixed_value"
            ],
            "value": "years"
        },
        {
            "key": "validity.duration_value",
            "optional": false,
            "enabled": true,
            "sources": [
                "fixed_value"
            ],
            "value": 1
        },
        {
            "key": "allow_any_key_type",
            "optional": false,
            "enabled": true,
            "sources": [
                "fixed_value"
            ],
            "value": "yes"
        },
        {
            "key": "allowed_key_types",
            "optional": false,
            "enabled": true,
            "sources": [
                "fixed_value"
            ],
            "value": []
        }
    ],
    "certificate_type": "end_entity"
}'

Set the body fields:

account_id: Your DigiCert ONE account ID (a valid UUID)
name: Unique name of the C2PA certificate profile
certcentral_container_id: Numeric ID of the CertCentral container that contains your validated C2PA organization. Replace 12345 with your container ID.
ca_connector_type: CA connector type.

Successful response (201 Created):

{
    "id": "<CERTIFICATE_PROFILE_ID>",
    "name": "C2PA Certificate Profile",
    "account_id": "ID of the account the certificate profile belongs to (UUID)",
    "certificate_template": {},
    "allow_bare_public_key": false,
    "created_at": "2026-11-04T09:16:08Z",
    "status": "ACTIVE",
    "body": [
        {
            "key": "signature_algorithm",
            "optional": false,
            "sources": [
                "fixed_value"
            ],
            "value": "sha256",
            "enabled": true
        },
        {
            "key": "subject.common_name",
            "optional": false,
            "sources": [
                "user_supplied",
                "csr"
            ],
            "enabled": true
        },
        {
            "key": "subject.organization_name",
            "optional": false,
            "sources": [
                "user_supplied",
                "csr",
                "fixed_value"
            ],
            "value": "Unique value of the organization (12345)",
            "enabled": true
        },
        {
            "key": "subject.organization_unit",
            "optional": true,
            "sources": [],
            "enabled": false
        },
        {
            "key": "san.dns_name",
            "optional": true,
            "sources": [],
            "enabled": false
        },
        {
            "key": "san.email",
            "optional": true,
            "sources": [],
            "enabled": false
        },
        {
            "key": "san.user_principal_name",
            "optional": true,
            "sources": [],
            "enabled": false
        },
        {
            "key": "validity.duration_unit",
            "optional": false,
            "sources": [
                "fixed_value"
            ],
            "value": "years",
            "enabled": true
        },
        {
            "key": "validity.duration_value",
            "optional": false,
            "sources": [
                "fixed_value"
            ],
            "value": 1,
            "enabled": true
        },
        {
            "key": "allow_any_key_type",
            "optional": false,
            "sources": [
                "fixed_value"
            ],
            "value": "yes",
            "enabled": true
        },
        {
            "key": "allowed_key_types",
            "optional": false,
            "sources": [
                "fixed_value"
            ],
            "value": [
                "rsa_1024",
                "rsa_2048",
                "rsa_3072",
                "rsa_4096",
                "p_256",
                "p_384",
                "p_521",
                "ed_25519",
                "slhdsa_sha2_128f",
                "slhdsa_sha2_128s",
                "slhdsa_sha2_192f",
                "slhdsa_sha2_192s",
                "slhdsa_sha2_256f",
                "slhdsa_sha2_256s",
                "slhdsa_shake_128f",
                "slhdsa_shake_128s",
                "slhdsa_shake_192f",
                "slhdsa_shake_192s",
                "slhdsa_shake_256f",
                "slhdsa_shake_256s"
            ],
            "enabled": true
        }
    ],
    "ca": [],
    "enrollment_methods": [],
    "certificate_type": "end_entity",
    "ca_connector_type": "digicert_cis",
    "ca_connector_id": "ID of the CA connector",
    "ca_connector_name": "C2PA Connector",
    "ca_connector_status": "ACTIVE",
    "ca_connector_cert_profile": "c2pa",
    "omit_primitive_encoding": false,
    "divisions": [],
    "is_migrated": false,
    "certcentral_container_id": 73510
}

Save the id value as CERTIFICATE_PROFILE_ID. You will use it as the certificate_profile_id when creating the C2PA certificate management policy in Step 6.

Step 6: Create a C2PA certificate management policy

Create a certificate management policy that uses the C2PA certificate profile created in Step 5: Create a C2PA certificate profile. The policy controls how customers request C2PA claim signing certificates, including the applicable division, certificate issuance method, and client-side key generation requirement.

Because C2PA policies prohibit CA-generated private keys, certificate requesters must generate the private key and submit a certificate signing request (CSR).

Request:

curl --request POST \
  --url 'https://demo.one.digicert.com/devicetrustmanager/certificate-configuration-service/api/v2/certificate-policy' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <DEVCTM_SOLUTION_ADMINISTRATOR_API_KEY>' \
  --data '{
    "certificate_policy": {
      ...
    }
  }'
    "certificate_management_methods": [
        "SINGLE"
    ],
    "single_cert_request_parameters": {
        "include_chain_option": "include_ica_and_root",
        "allow_key_cache": false,
        "split_certificate_response": false,
        "private_key_format": "pem"
    },
    "name": "C2PA Cert Management Policy",
    "ica_id": "",
    "created_at": "2026-11-04T12:50:10.087Z",
    "certificate_profile_id": "ID of the C2PA certificate profile",
    "division_id": "ID of an existing division",
    "require_approval_for_enroll": false,
    "key_generation_option": "client_side",
    "allowed_ip_addresses": [],
    "labels": [],
    "allow_unauthenticated_certificate_download": false,
    "scep_get_ca_cert_response_include_full_chain": false
    }
}

Set the body fields:

certificate_management_methods: Array of certificate issuance methods. Allowed values: SINGLE, BATCH, TRUST_EDGE, EST, SCEP, CMP_V2, ACME. Use SINGLE for creating issuing a C2PA claim signing certificate.
single_cert_request_parameters: Certificate parameters to include.
private_key_format: Format of the private key.
certificate_profile_id: ID of the certificate profile you have already created.
division_id: ID of an existing division.
key_generation_option: One of client_side, server_side, or client_or_server_side.

Successful response (201 Created):

{
    "name": "C2PA Cert Management Policy1",
    "certificate_management_methods": [
        "SINGLE"
    ],
    "enrollment_methods": [
        "SINGLE"
    ],
    "allowed_ip_addresses": [],
    "key_generation_allow_to_change": false,
    "key_generation_option": "client_side",
    "allow_pre_generated_keys": false,
    "ca_connector_id": "ID of the CA connector",
    "ca_connector_name": "C2PA Connector",
    "ca_connector_type": "digicert_cis",
    "assign_to_authcert_device": false,
    "allow_key_cache": false,
    "allow_unauthenticated_certificate_download": false,
    "division_id": "ID of an existing division",
    "require_approval_for_enroll": false,
    "require_approval_for_renew": false,
    "notification_email_list": [],
    "digest_email_notification_period": "do_not_send",
    "require_digital_signing": false,
    "new_batch_flow": true,
    "single_cert_request_parameters": {
        "key_generation_option": "client_side",
        "key_generation_allow_to_change": false,
        "allow_to_use_pregenerated_keys": false,
        "private_key_format": "pem",
        "allow_key_cache": false,
        "rsa_private_key_syntax": "pkcs8",
        "ecdsa_private_key_syntax": "pkcs8",
        "response_with_certificate_only": false,
        "split_certificate_response": false,
        "include_chain_option": "include_ica_and_root"
    },
    "migrated_to_new_params": false,
    "scep_get_ca_cert_response_with_root": false,
    "scep_get_ca_cert_response_der_format": false,
    "est_cacerts_include_full_tls_chain": false,
    "scep_get_ca_cert_response_include_full_chain": false,
    "labels": [],
    "is_migrated": false,
    "certificate_policy_id": "<CERTIFICATE_POLICY_ID>",
    "certificate_profile": {
        "id": "ID of the C2PA certificate profile",
        "name": "C2PA Certificate Profile"
    },
    "created_at": "2026-11-04T12:59:31Z",
    "ica": {
        "id": ""
    },
    "status": "ACTIVE",
    "allowed_signature_algorithms": [],
    "direct_mapping": true,
    "account_id": "Your DigiCert ONE account ID",
    "certificate_type": "end_entity",
    "approvers": [],
    "ca_chain": [],
    "certificate_template": {},
    "require_approval_for_revoke": false,
    "alternative_id": "Alternative ID"
}

Save the id value as CERTIFICATE_POLICY_ID. You will use it as the certificate_policy_id when requesting the C2PA claim signing certificate in Step 7.

Step 7: Request a C2PA claim signing certificate

The C2PA Certificate Policy prohibits the CA from generating private keys for claim signing certificates. You must generate the private key and submit a Certificate Signing Request (CSR).

Request:

curl --location 'https://demo.one.digicert.com/devicetrustmanager/certificate-issuance-service/api/v2/certificate' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'x-api-key: <DEVCTM_SOLUTION_ADMINISTRATOR_API_KEY>' \
--data '{
    "certificate_policy_id": "CERTIFICATE_POLICY_ID",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----\n", 
    "certificate_profile_attributes": [
         {
    "id": "subject.organization_name",
    "value": "<VALIDATED_ORGANIZATION_NAME_AND_ID>"
  },
  {
    "id": "certificate.conforming_product_record_id",
    "value": "<CONFORMING_PRODUCT_RECORD_ID>"
  }
],
    "custom_attributes": [],
    "device_attributes": [],
    "response_with_certificate_only": false,
    "split_certificate_response": true,
    "include_certificate_chain": true,
    "server_side_key_gen": false
}'

Successful response (200 OK):


{
    "certificate_request_id": "ID of the certificate",
    "status": "AUTO_APPROVED",
    "result": "SUCCESS",
    "certificate_id": "ID of the certificate",
    "pem": "-----BEGIN CERTIFICATE-----\n<BASE64_ENCODED_CERTIFICATE>\n-----END CERTIFICATE-----\n",
    "ica": "-----BEGIN CERTIFICATE-----\n<BASE64_ENCODED_ICA_CERTIFICATE>\n-----END CERTIFICATE-----\n",
    "certificate_value": "Value of the certificate",
    "chain": [
        {
            "type": "intermediate",
            "body": "-----BEGIN CERTIFICATE-----\n<BASE64_ENCODED_CERTIFICATE>\n-----END CERTIFICATE-----\n"
        },
        {
            "type": "root",
            "body": "-----BEGIN CERTIFICATE-----\n<BASE64_ENCODED_CERTIFICATE>\n-----END CERTIFICATE-----\n"
        }
    ],
    "serial_number": "Serial number",
    "thumbprint_sha256": "thumbprint_sha256",
    "common_name": "Common name",
    "valid_from": "2026-11-05T00:00:00Z",
    "valid_to": "2027-11-05T23:59:59Z",
    "certificate_status": "ISSUED"
}

Common errors and solutions

For general authentication, authorization, and rate-limit errors, see Error handling and rate limits.

CA connector not found

Confirm that the connector ID identifies the active CertCentral CA connector created in Step 3. The connector ID must be a UUID without brackets, quotation marks, or whitespace.

C2PA product is unavailable

Confirm that the certificate profile uses c2pa for ca_connector_cert_profile and that the CertCentral account has finished the required C2PA setup and CA provisioning.

No validated organization is available

Confirm that C2PA validation for the organization is current and that its name exactly matches the organization registered in the C2PA Conforming Products List.

A conforming product must be selected

Include certificate.conforming_product_record_id in certificate_profile_attributes and provide the record ID for the registered generator product.

Invalid conforming-product selection

Confirm that the conforming-product value is the record ID returned for the registered product. Do not use the product’s display name unless the API contract explicitly requires the formatted display value.

CSR is missing or invalid

Generate the private key and CSR on the requesting system. Send the complete PEM-encoded CSR, including its BEGIN and END lines, and set server_side_key_gen to false.

Certificate validity is not allowed

Use a validity period supported by the selected CertCentral C2PA product. Do not exceed the validity values returned for that product.

What’s next?

After you receive the C2PA claim signing certificate:

Install the certificate and its chain with the corresponding private key on the authorized generator device.
Configure the device’s C2PA implementation to use the certificate and private key when signing Content Credentials.
Protect the private key against export, unauthorized access, and reuse on unregistered products.
Test the resulting Content Credentials with a compatible C2PA validation tool.
Plan how you will renew and replace the certificate before its end date.

For more information about using C2PA claim signing certificates, see C2PA claim signing certificates.

Was this page helpful?

Provide feedback

Need more help?

Account and platform

Certificates and PKI

Signing

Devices and IoT

Other resources

Issue C2PA claim signing certificates

What this tutorial covers

What this tutorial does not cover

Before you begin

Endpoint overview

Reference values

Step 1: Set up CertCentral

Step 2: Create a CertCentral API key

Step 3: Create a CA connector for CertCentral

Step 4: Verify the CertCentral CA connector

Step 5: Create a C2PA certificate profile

Step 6: Create a C2PA certificate management policy

Step 7: Request a C2PA claim signing certificate

Common errors and solutions

CA connector not found

C2PA product is unavailable

No validated organization is available

A conforming product must be selected

Invalid conforming-product selection

CSR is missing or invalid

Certificate validity is not allowed

What’s next?