Skip to main content

CAWG identity FAQs

Does c2pa-rs support identity claims aggregation?​

Yes. c2pa-rs supports CAWG identity claims aggregation (ICA), with an implementation also using the Node bindings. You still need to provide an aggregation service that returns the COSE-signed verifiable credential; SDK support does not supply that service.

See the Rust identity module and its tests. Equivalent ICA support in the Swift or Python SDKs is not confirmed here.

Source: Rust and Node ICA support and service responsibilities; August 14, 2026

How can I inspect CAWG certificate fields when common_name is missing?​

Use crJSON to inspect certificate issuer and subject information when the ordinary CAWG signature report omits common_name:

c2patool signed.jpg --crjson

The example places these fields under cawg.identity.signature.certificateInfo, including issuer, subject, and certificate validity dates. The common name is visible through --crjson.

This is a reporting workaround for the issue observed in May 2026, not evidence that the missing field has since been fixed. Reading a certificate subject also does not establish that its identity is trusted.

Sources:

Does a CAWG identity certificate need to chain to the C2PA Trust List?​

No. The C2PA Trust List contains roots for claim-signing certificates issued to generator products that have passed C2PA Conformance. CAWG X.509 identity certificates use a different model.

As of August 2026, CAWG's interim model used the Mozilla Root Store and IPTC verified news publisher lists. See the CAWG identity 1.3 X.509 trust model, the Mozilla email-trust roots and the IPTC end-entity and anchor lists.

Do not equate C2PA product trust with CAWG identity trust, or treat the historical interim model as an independently verified current policy.

S/MIME certificates are a common CAWG X.509 choice, including individual-validated, sponsor-validated, and organization-validated certificates. Having a government-issued identity certificate does not by itself answer whether it meets CAWG's requirements; check the CAWG X.509 trust model rather than the C2PA product Trust List.

Sources:

Why can CAWG identity remain untrusted when the claim signer is trusted?​

CAWG trust anchors need separate SDK configuration. Trust in the C2PA claim signer does not automatically establish trust in the identity assertion. Two possible causes are that the validator did not configure CAWG anchors, or using a CAWG certificate that does not chain to the anchors that validator uses.

Inspect the validation result's assertion URL to determine whether signingCredential.untrusted refers to cawg.identity rather than the claim signature. A successful signature or well-formedness check is not a substitute for the identity trust check.

Sources:

Are there source-linked guides for CAWG on mobile?​

For a Proofmode Android workflow using CAWG X.509 assertions and SSL.com identity-validated certificates with captured photos and videos, see the user guide. This functionality was available in a Proofmode Android release in October 2026.

For SDK integration, see the CAWG mobile SDK developer guide. These resources are not independently reviewed instructions or a guarantee of support across all mobile SDKs, certificate authorities, or identity mechanisms.

Sources:

Use CAWG identity and metadata assertions instead of stds.schema-org.CreativeWork for creator-related data. See cawg.io. Identity trust must still be evaluated separately.

Source: CAWG identity and metadata recommendation; August 31, 2026

Can my organization's identity certificate identify all my users?​

No. With the CAWG X.509 method, each user would need a CAWG certificate issued with that user's own name or organization. Your organization's certificate asserts your organization's identity, not the identities of all its users. Consider Identity Claims Aggregation for platforms.

Becoming a C2PA CA is a separate role: issuing signing certificates to conforming products. To attach artist, creator, or publisher identity, use the CAWG identity assertion, using an X.509 certificate or Identity Claims Aggregation.

Sources: