Contact Us Now for C2PA Solutions
A Standard Worth Getting Right
AI-generated media is everywhere, and it’s getting harder by the month to tell what’s real, what’s edited, and what’s fabricated from scratch. C2PA gives creators, publishers, and platforms a way to attach verifiable, cryptographically signed information to a piece of content: where it came from, what tools touched it, and what changed along the way.Earlier this year, the standard took a meaningful step forward. Products that sign C2PA manifests now must pass a conformance program before they can get a certificate from a trusted Certificate Authority like SSL. That closes a real gap. A signature is only as trustworthy as the process behind it, and conformance testing means the tools generating these manifests behave the way they claim to.
But it also raises a question: Who gets left out when the bar goes up?
When the Barrier Becomes a Blocker
Every time an industry adds a layer of rigor, it adds a layer of cost. That’s not a criticism. Rigor, after all, is expensive to build and maintain and can be even more expensive to verify. But the organizations that can absorb that cost easily aren’t always the ones building the most innovative things.The innovative work in content authenticity right now isn’t coming from a handful of massive incumbents. It’s coming from small teams building capture apps, editing tools, and publishing platforms who saw the provenance problem early and decided to do something about it. Some of them are well-funded. Many of them aren’t. They’re bootstrapped, or they’re a handful of engineers trying to get a conformant product out the door before their runway ends.
If trusted signing infrastructure is priced like an enterprise contract, we end up with a standard that only enterprises can fully participate in. That’s exactly how good standards stall out. The technology is sound, the incentives are aligned, and the whole thing still moves slower than it should because the first step costs more than a small team can justify.
I don’t think that’s acceptable for something as foundational as content authenticity. Provenance shouldn’t be a premium feature. It should be table stakes that need to be within reach for all players.
What SSL Is Doing About It
SSL now offers free Assurance Level 1 C2PA Claim Signing Certificates, valid for one year, to qualify C2PA conformant generator products. Each certificate includes up to 10,000 trusted timestamps. While a signature tells you content wasn’t altered, a timestamp tells you when that signature happened, which is what lets a credential hold up months or years later – long after the signing certificate expires or is revoked.For a startup or an early-stage platform, this removes one of the first real obstacles between “we built a conformant product” and “we’re actually issuing trusted content credentials in production.” No procurement cycle, no enterprise sales conversation, no budget line item standing between a great concept and a working implementation.
For organizations that need more than a free tier can offer, our Premium Tier covers technical support, APIs, SLAs, automation, CAWG reselling, and warranties at enterprise scale. That tier exists because some organizations genuinely need it. But needing more shouldn’t be the price of entry. It should be an option for later, not a day one requirement.
Why This Matters Beyond Us
We believe that by offering free trusted tiers of C2PA certificates and timestamps, we can help prospective and established applications reach full compliance more quickly and accelerate C2PA adoption by reducing certain barriers early on. When more conformant products are signing manifests, provenance data becomes more consistent, more common, and more useful to everyone downstream, including your prospects and customers who are trying to figure out what they can trust.The long-term winner in content authenticity won’t be decided by which Certificate Authority signs the most manifests. It’s going to be decided by whether the standard itself reaches the kind of broad, boring, everywhere adoption that TLS eventually reached for the web. That’s the outcome we should want for content provenance, too. Not a niche practice for security-conscious publishers, but a default assumption for anyone consuming digital media.
We don’t get there by making trusted infrastructure a luxury. We get there by making it available to the developer building a conformant capture tool in their spare room just as readily as we make it available to a platform with a nine-figure budget.
If what you’re building requires C2PA-conformance but cost has been holding you back, I’d encourage you to contact our team and discuss the options we have for you.
Contact Us Now for C2PA Solutions
Leo Grove is the CEO, President, and Founder of SSL.com, a leading certificate authority and provider of PKI solutions. He has spent decades working at the intersection of internet security, digital trust, and emerging technology standards.
