Prove it existed, and keep it valid long after the certificate expires
What is a Time Stamping Authority?
How a trusted timestamp keeps your manifest valid
1. Hash COSE ToBeSigned value (CounterSignature context)
2. Request RFC 3161 TimeStampReq → SSL.com TSA (RSA or ECC)
3. Sign TSA binds hash to trusted time, HSM-signed TimeStampToken
4. Embed token added as COSE_Sign1 countersignature
5. Validate verifiable indefinitely, even after cert expiry
Available TSA endpoints
| Endpoint | Algorithm | Description |
|---|---|---|
http://ts-c2pa.ssl.com/rsa | RSA | C2PA-compliant RFC 3161 Time Stamping Authority API with RSA |
http://ts-c2pa.ssl.com/ecc | ECC | C2PA-compliant RFC 3161 Time Stamping Authority API with ECC |
Who is it for?
C2PA claim generators & platforms
Embed trusted timestamps so Content Credentials survive certificate expiry.
Camera & device manufacturers
Attach proof-of-existence at capture, or shortly after for offline capture.
AI media platforms
Timestamp generated content to keep provenance manifests durable.
C2PA conformant products
Obtain trusted timestamps for long-term manifest validation.
Request C2PA TSA access
Contact our content authenticity team to set up access to SSL.com’s C2PA-compliant Time Stamping Authority. We’ll confirm your use case, endpoint needs (RSA or ECC), and volume so you can start embedding trusted timestamps in your C2PA manifests.
Why SSL.com
RFC 3161 compliant
Trusted, audited time source
Purpose-built for C2PA
WebTrust audited (BDO)
In operation since 2002
Frequently asked questions
Without a trusted timestamp, a manifest stops being valid as soon as the signing certificate expires or is revoked. A timestamp lets a validator confirm the claim was signed while the credential was valid, so the manifest can be validated indefinitely.
It is a special C2PA manifest that provides proof-of-existence for an asset and its manifest at a trusted time. It is most often used when an earlier generator signed offline and could not obtain a timestamp at signing time.
No. Only a hash (message imprint) is sent to the TSA. The actual content never leaves your environment.
Match the endpoint to your C2PA signing workflow and the algorithms your validators expect. Both are C2PA-compliant; ECC produces smaller tokens, RSA offers the broadest compatibility.
The C2PA platform free tier includes 10,000 timestamps per year, with on-demand pricing for additional volume. Premium customers can buy at a reduced bulk rate.
