--- title: "Issue C2PA claim signing certificates" description: "Configure and issue C2PA claim signing certificates for compliant camera devices to embed trusted content provenance and authenticity information.\n" source_url: https://dev.digicert.com/device-trust-api/tutorials/issue-c2pa-claim-signing-certificates.html --- C2PA is an open technical standard for adding tamper-evident provenance metadata, known as **Content Credentials**, to digital assets such as images and videos. DigiCert Device Trust Manager supports issuing **C2PA level 1 claim signing certificate**, allowing manufacturers to integrate content credentials into camera and video devices. For more information about C2PA requirements, account setup, and certificate issuance, see [C2PA claim signing certificates](https://docs.digicert.com/en/device-trust-manager/manage-certificates/issue-specialized-certificates/issue-c2pa-claim-signing-certificates.html). ## What this tutorial covers In this tutorial, you will: - Finish the required CertCentral setup for C2PA certificate issuance - Create a CertCentral API key - Create a CertCentral CA connector in Device Trust Manager - Create a C2PA certificate profile using the CertCentral CA connector - Create a certificate management policy that requires client-side key generation - Submit a CSR and request a C2PA claim signing certificate ## What this tutorial does not cover This tutorial does not explain how to: - Set up your account for C2PA - Add your generator product to the C2PA Conforming Products List - Finish C2PA organization validation - Have DigiCert provision the required certificate authorities - Add Content Credentials to media or validate signed media Complete these requirements before using this API workflow. For instructions, see [C2PA claim signing certificates](https://docs.digicert.com/en/device-trust-manager/manage-certificates/issue-specialized-certificates/issue-c2pa-claim-signing-certificates.html). ## Before you begin Before you begin, make sure you have: - A DigiCert® ONE account with access to Device Trust Manager and CertCentral. - A CertCentral account that has finished the C2PA account setup, organization validation, registered-product setup, and CA provisioning requirements. - A Device Trust Manager API key (`DEVCTM_SOLUTION_ADMINISTRATOR`) with the **Solution Administrator** role. - Your DigiCert ONE account ID and the ID of the Device Trust Manager division where you will create the certificate profile and policy. For instructions on creating a division, see **Step 1: Create a division** under [Register multiple devices](https://dev.digicert.com/device-trust-api/tutorials/register-multiple-devices.html). - A supported tool for generating and securely storing a private key and CSR. The C2PA Certificate Policy requires you to generate the private key and submit a CSR. ## Endpoint overview | Method | Path | Description | |---|---|---| | GET | `/devicetrustmanager/api/v4/division` | Find the division ID | | GET | `/devicetrustmanager/certificate-configuration-service/api/v1/ca-connector/{id}` | Verify the CertCentral CA connector | | POST | `/devicetrustmanager/certificate-configuration-service/api/v1/certificate-profile` | Create the C2PA certificate profile | | POST | `/devicetrustmanager/certificate-configuration-service/api/v2/certificate-policy` | Create the C2PA certificate management policy | | POST | `/devicetrustmanager/certificate-issuance-service/api/v2/certificate` | Request a C2PA claim signing certificate | ## Reference values | Field | Value for this tutorial | Purpose | |---|---|---| | `ca_connector_type` | `digicert_cis` | Uses the CertCentral CA connector | | `ca_connector_cert_profile` | `c2pa` | Selects the CertCentral C2PA product | | `certificate_type` | `end_entity` | Creates an end-entity claim signing certificate profile | | `certificate_management_methods` | `SINGLE` | Allows individual certificate requests through the REST API | | `key_generation_option` | `client_side` | Requires the requester to generate and retain the private key | | `server_side_key_gen` | `false` | Submits a CSR instead of requesting server-side key generation | | `response_with_certificate_only` | `false` | Returns a JSON response | | `split_certificate_response` | `true` | Returns the end-entity certificate separately from its chain | | `include_certificate_chain` | `true` | Includes intermediate and root certificates in the response | ## Step 1: Set up CertCentral Complete **Step 1: Set up CertCentral** under [C2PA claim signing certificates](https://docs.digicert.com/en/device-trust-manager/manage-certificates/issue-specialized-certificates/issue-c2pa-claim-signing-certificates.html) before continuing with this tutorial. During this setup, provide your organization details and select your registered generator product. The organization name in CertCentral must exactly match the organization name in the C2PA Conforming Products List. Continue to [Step 2: Create a CertCentral API key](#step-2-create-a-certcentral-api-key) after DigiCert finishes the C2PA organization validation. ## Step 2: Create a CertCentral API key Create a CertCentral API key for the CA connector in Device Trust Manager. 1. Sign in to CertCentral. 2. In the left menu, go to **Automation** > **API Keys**. 3. Select **Add API Key**. 4. Provide a **Description** that identifies the key. For example, `C2PA Connector Key`. 5. In the **User** menu, link the API key to either a **Service User** or **Users**. 6. Leave the **API key restrictions** menu blank (`None`). 7. Select **Add API Key**. 8. In the **New API Key** window, copy the API Key. 9. Store it in a secure location. > **Note** > > The API keys are shown only once, do not leave this page until you have copied the API Key and stored it in a secure location. 10. After saving the API key (or keys), select **I understand I will not see this again**. > **Tip** > > If you lose the API key, you can always create another API key. You will use this key in [Step 3: Create a CA connector for CertCentral](#step-3-create-a-ca-connector-for-certcentral). ## Step 3: Create a CA connector for CertCentral Create the CA connector through the Device Trust Manager portal. 1. Sign in to DigiCert ONE. 2. In the **Managers** menu, select **Device Trust**. 3. In the Device Trust Manager menu, go to **Integrations** > **CA connectors**. 4. Select **Create CA connector**. 5. Provide a **Nickname** that identifies the connector. For example, `C2PA Connector`. 6. Optionally, provide a description. 7. For CA source, select **CertCentral API**. 8. Enter the CertCentral API key you created in Step 2. 9. Select **Create CA connector**. Device Trust Manager lists the connector under **Integrations** > **CA connectors**. Note down the CA connector ID. You will use it in [Step 5: Create a C2PA certificate profile](#step-5-create-a-c2pa-certificate-profile). ## Step 4: Verify the CertCentral CA connector Retrieve the ID of the CertCentral CA connector created in [Step 3](#step-3-create-a-ca-connector-for-certcentral). You will use this ID when creating the C2PA certificate profile. Do not use a certificate template ID for this. The certificate profile request uses the CertCentral CA connector ID. The CA connector ID resembles the following example: `82251327-6093-47e5-9e36-8e9264c5df9a` **Request**: ```bash **Request**: ```bash curl --request GET \ --url 'https://demo.one.digicert.com/devicetrustmanager/certificate-configuration-service/api/v1/ca-connector/' \ --header 'Accept: application/json' \ --header 'x-api-key: ' ``` **Set the path parameter**: `CA_CONNECTOR_ID`: ID of the CertCentral CA connector created in [Step 3](#step-3-create-a-ca-connector-for-certcentral). **Successful response (200 OK)**: ```json { "id": "", "account_id": "", "url": "https://www.digicert.com", "name": "C2PA Connector", "description": "C2PA Connector", "connector_type": "digicert_cis", "auth_type": "api_key", "status": "ACTIVE", "created_at": "2026-10-29T12:12:28Z" } ``` ## Step 5: Create a C2PA certificate profile Create a certificate profile that uses the CertCentral CA connector ID from [Step 3: Create a CA connector for CertCentral](#step-3-create-a-ca-connector-for-certcentral). This certificate profile defines the CertCentral C2PA certificate product, validated organization, registered product, permitted signature algorithms, certificate validity period, renewal settings, and divisions that apply to C2PA claim signing certificate request. **Request:** ```bash curl --location 'https://demo.one.digicert.com/devicetrustmanager/certificate-configuration-service/api/v1/certificate-profile' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'x-api-key: DEVCTM_SOLUTION_ADMINISTRATOR_API_KEY' \ --data '{ "account_id": "ID of the account the certificate profile belongs to (UUID)", "name": "C2PA Certificate Profile", "ca_connector_type": "digicert_cis", "ca_connector_id": "ID of the CA connector", "ca_connector_end_entity_profile": "", "ca_connector_cert_profile": "c2pa", "certcentral_container_id": <12345>, "ca_connector_name": "C2PA Connector", "ca_connector_status": "ACTIVE", "status": "ACTIVE", "divisions": [], "omit_primitive_encoding": false, "body": [ { "key": "signature_algorithm", "optional": false, "enabled": true, "sources": [ "fixed_value" ], "value": "sha256" }, { "key": "subject.common_name", "optional": false, "enabled": true, "sources": [ "user_supplied", "csr" ], "value": "" }, { "key": "subject.organization_name", "optional": false, "enabled": true, "sources": [ "user_supplied", "csr", "fixed_value" ], "value": "Unique value of the organization (12345)" }, { "key": "subject.organization_unit", "optional": true, "enabled": false, "sources": [], "value": [] }, { "key": "san.dns_name", "optional": true, "enabled": false, "sources": [], "value": [] }, { "key": "san.email", "optional": true, "enabled": false, "sources": [], "value": [] }, { "key": "san.user_principal_name", "optional": true, "enabled": false, "sources": [], "value": [] }, { "key": "csr", "optional": false, "enabled": true, "sources": [ "user_supplied" ], "value": null }, { "key": "validity.duration_unit", "optional": false, "enabled": true, "sources": [ "fixed_value" ], "value": "years" }, { "key": "validity.duration_value", "optional": false, "enabled": true, "sources": [ "fixed_value" ], "value": 1 }, { "key": "allow_any_key_type", "optional": false, "enabled": true, "sources": [ "fixed_value" ], "value": "yes" }, { "key": "allowed_key_types", "optional": false, "enabled": true, "sources": [ "fixed_value" ], "value": [] } ], "certificate_type": "end_entity" }' ``` **Set the body fields**: - `account_id`: Your DigiCert ONE account ID (a valid UUID) - `name`: Unique name of the C2PA certificate profile - `certcentral_container_id`: Numeric ID of the CertCentral container that contains your validated C2PA organization. Replace `12345` with your container ID. - `ca_connector_type`: CA connector type. **Successful response (201 Created)**: ```json { "id": "", "name": "C2PA Certificate Profile", "account_id": "ID of the account the certificate profile belongs to (UUID)", "certificate_template": {}, "allow_bare_public_key": false, "created_at": "2026-11-04T09:16:08Z", "status": "ACTIVE", "body": [ { "key": "signature_algorithm", "optional": false, "sources": [ "fixed_value" ], "value": "sha256", "enabled": true }, { "key": "subject.common_name", "optional": false, "sources": [ "user_supplied", "csr" ], "enabled": true }, { "key": "subject.organization_name", "optional": false, "sources": [ "user_supplied", "csr", "fixed_value" ], "value": "Unique value of the organization (12345)", "enabled": true }, { "key": "subject.organization_unit", "optional": true, "sources": [], "enabled": false }, { "key": "san.dns_name", "optional": true, "sources": [], "enabled": false }, { "key": "san.email", "optional": true, "sources": [], "enabled": false }, { "key": "san.user_principal_name", "optional": true, "sources": [], "enabled": false }, { "key": "validity.duration_unit", "optional": false, "sources": [ "fixed_value" ], "value": "years", "enabled": true }, { "key": "validity.duration_value", "optional": false, "sources": [ "fixed_value" ], "value": 1, "enabled": true }, { "key": "allow_any_key_type", "optional": false, "sources": [ "fixed_value" ], "value": "yes", "enabled": true }, { "key": "allowed_key_types", "optional": false, "sources": [ "fixed_value" ], "value": [ "rsa_1024", "rsa_2048", "rsa_3072", "rsa_4096", "p_256", "p_384", "p_521", "ed_25519", "slhdsa_sha2_128f", "slhdsa_sha2_128s", "slhdsa_sha2_192f", "slhdsa_sha2_192s", "slhdsa_sha2_256f", "slhdsa_sha2_256s", "slhdsa_shake_128f", "slhdsa_shake_128s", "slhdsa_shake_192f", "slhdsa_shake_192s", "slhdsa_shake_256f", "slhdsa_shake_256s" ], "enabled": true } ], "ca": [], "enrollment_methods": [], "certificate_type": "end_entity", "ca_connector_type": "digicert_cis", "ca_connector_id": "ID of the CA connector", "ca_connector_name": "C2PA Connector", "ca_connector_status": "ACTIVE", "ca_connector_cert_profile": "c2pa", "omit_primitive_encoding": false, "divisions": [], "is_migrated": false, "certcentral_container_id": 73510 } ``` Save the `id` value as `CERTIFICATE_PROFILE_ID`. You will use it as the `certificate_profile_id` when creating the C2PA certificate management policy in [Step 6](#step-6-create-a-c2pa-certificate-management-policy). ## Step 6: Create a C2PA certificate management policy Create a certificate management policy that uses the C2PA certificate profile created in [Step 5: Create a C2PA certificate profile](#step-5-create-a-c2pa-certificate-profile). The policy controls how customers request C2PA claim signing certificates, including the applicable division, certificate issuance method, and client-side key generation requirement. Because C2PA policies prohibit CA-generated private keys, certificate requesters must generate the private key and submit a certificate signing request (CSR). **Request**: ```bash curl --request POST \ --url 'https://demo.one.digicert.com/devicetrustmanager/certificate-configuration-service/api/v2/certificate-policy' \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header 'x-api-key: ' \ --data '{ "certificate_policy": { ... } }' "certificate_management_methods": [ "SINGLE" ], "single_cert_request_parameters": { "include_chain_option": "include_ica_and_root", "allow_key_cache": false, "split_certificate_response": false, "private_key_format": "pem" }, "name": "C2PA Cert Management Policy", "ica_id": "", "created_at": "2026-11-04T12:50:10.087Z", "certificate_profile_id": "ID of the C2PA certificate profile", "division_id": "ID of an existing division", "require_approval_for_enroll": false, "key_generation_option": "client_side", "allowed_ip_addresses": [], "labels": [], "allow_unauthenticated_certificate_download": false, "scep_get_ca_cert_response_include_full_chain": false } } ``` **Set the body fields**: - `certificate_management_methods`: Array of certificate issuance methods. Allowed values: `SINGLE`, `BATCH`, `TRUST_EDGE`, `EST`, `SCEP`, `CMP_V2`, `ACME`. Use `SINGLE` for creating issuing a C2PA claim signing certificate. - `single_cert_request_parameters`: Certificate parameters to include. - `private_key_format`: Format of the private key. - `certificate_profile_id`: ID of the certificate profile you have already created. - `division_id`: ID of an existing division. - `key_generation_option`: One of `client_side`, `server_side`, or `client_or_server_side`. **Successful response (201 Created):** ```json { "name": "C2PA Cert Management Policy1", "certificate_management_methods": [ "SINGLE" ], "enrollment_methods": [ "SINGLE" ], "allowed_ip_addresses": [], "key_generation_allow_to_change": false, "key_generation_option": "client_side", "allow_pre_generated_keys": false, "ca_connector_id": "ID of the CA connector", "ca_connector_name": "C2PA Connector", "ca_connector_type": "digicert_cis", "assign_to_authcert_device": false, "allow_key_cache": false, "allow_unauthenticated_certificate_download": false, "division_id": "ID of an existing division", "require_approval_for_enroll": false, "require_approval_for_renew": false, "notification_email_list": [], "digest_email_notification_period": "do_not_send", "require_digital_signing": false, "new_batch_flow": true, "single_cert_request_parameters": { "key_generation_option": "client_side", "key_generation_allow_to_change": false, "allow_to_use_pregenerated_keys": false, "private_key_format": "pem", "allow_key_cache": false, "rsa_private_key_syntax": "pkcs8", "ecdsa_private_key_syntax": "pkcs8", "response_with_certificate_only": false, "split_certificate_response": false, "include_chain_option": "include_ica_and_root" }, "migrated_to_new_params": false, "scep_get_ca_cert_response_with_root": false, "scep_get_ca_cert_response_der_format": false, "est_cacerts_include_full_tls_chain": false, "scep_get_ca_cert_response_include_full_chain": false, "labels": [], "is_migrated": false, "certificate_policy_id": "", "certificate_profile": { "id": "ID of the C2PA certificate profile", "name": "C2PA Certificate Profile" }, "created_at": "2026-11-04T12:59:31Z", "ica": { "id": "" }, "status": "ACTIVE", "allowed_signature_algorithms": [], "direct_mapping": true, "account_id": "Your DigiCert ONE account ID", "certificate_type": "end_entity", "approvers": [], "ca_chain": [], "certificate_template": {}, "require_approval_for_revoke": false, "alternative_id": "Alternative ID" } ``` Save the `id` value as `CERTIFICATE_POLICY_ID`. You will use it as the `certificate_policy_id` when requesting the C2PA claim signing certificate in [Step 7](#step-7-request-a-c2pa-claim-signing-certificate). ## Step 7: Request a C2PA claim signing certificate > **Note** > > The **C2PA Certificate Policy prohibits the CA from generating private keys for claim signing certificates**. You must generate the private key and submit a Certificate Signing Request (CSR). **Request**: ```bash curl --location 'https://demo.one.digicert.com/devicetrustmanager/certificate-issuance-service/api/v2/certificate' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'x-api-key: ' \ --data '{ "certificate_policy_id": "CERTIFICATE_POLICY_ID", "csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----\n", "certificate_profile_attributes": [ { "id": "subject.organization_name", "value": "" }, { "id": "certificate.conforming_product_record_id", "value": "" } ], "custom_attributes": [], "device_attributes": [], "response_with_certificate_only": false, "split_certificate_response": true, "include_certificate_chain": true, "server_side_key_gen": false }' ``` **Successful response (200 OK)**: ```json { "certificate_request_id": "ID of the certificate", "status": "AUTO_APPROVED", "result": "SUCCESS", "certificate_id": "ID of the certificate", "pem": "-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----\n", "ica": "-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----\n", "certificate_value": "Value of the certificate", "chain": [ { "type": "intermediate", "body": "-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----\n" }, { "type": "root", "body": "-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----\n" } ], "serial_number": "Serial number", "thumbprint_sha256": "thumbprint_sha256", "common_name": "Common name", "valid_from": "2026-11-05T00:00:00Z", "valid_to": "2027-11-05T23:59:59Z", "certificate_status": "ISSUED" } ``` ## Common errors and solutions For general authentication, authorization, and rate-limit errors, see [Error handling and rate limits](https://dev.digicert.com/get-started/error-handling-rate-limits.html). ### CA connector not found Confirm that the connector ID identifies the active CertCentral CA connector created in Step 3. The connector ID must be a UUID without brackets, quotation marks, or whitespace. ### C2PA product is unavailable Confirm that the certificate profile uses `c2pa` for `ca_connector_cert_profile` and that the CertCentral account has finished the required C2PA setup and CA provisioning. ### No validated organization is available Confirm that C2PA validation for the organization is current and that its name exactly matches the organization registered in the C2PA Conforming Products List. ### A conforming product must be selected Include `certificate.conforming_product_record_id` in `certificate_profile_attributes` and provide the record ID for the registered generator product. ### Invalid conforming-product selection Confirm that the conforming-product value is the record ID returned for the registered product. Do not use the product's display name unless the API contract explicitly requires the formatted display value. ### CSR is missing or invalid Generate the private key and CSR on the requesting system. Send the complete PEM-encoded CSR, including its BEGIN and END lines, and set `server_side_key_gen` to `false`. ### Certificate validity is not allowed Use a validity period supported by the selected CertCentral C2PA product. Do not exceed the validity values returned for that product. ## What's next? After you receive the C2PA claim signing certificate: - Install the certificate and its chain with the corresponding private key on the authorized generator device. - Configure the device's C2PA implementation to use the certificate and private key when signing Content Credentials. - Protect the private key against export, unauthorized access, and reuse on unregistered products. - Test the resulting Content Credentials with a compatible C2PA validation tool. - Plan how you will renew and replace the certificate before its end date. For more information about using C2PA claim signing certificates, see [C2PA claim signing certificates](https://docs.digicert.com/en/device-trust-manager/manage-certificates/issue-specialized-certificates/issue-c2pa-claim-signing-certificates.html).