isGenAI.com

Glossary

Certificate: the identity behind a signed record

A signing certificate is an X.509 certificate, issued by a certificate authority, whose public key verifies a C2PA manifest’s signature and whose subject names the organisation that signed it, so that a validator can tell who vouched for the record and whether that identity is trusted.

Definitions and isGenAI behaviour as of October 2026. Updated .

See the term in a real reportFrequently asked questions
Code-drawn illustration for Certificate

Illustration · PNG file

  1. Signature + IHDR
  2. iTXt XML:com.adobe.xmprecord
  3. tEXt parameters
  4. tEXt prompt / workflow
  5. tEXt invokeai_metadata
  6. eXIf
  7. caBX C2PA manifest
  8. IDAT pixels
  9. IEND

AI source type declared

The file labels itself as AI-made.

IPTC DigitalSourceType such as trainedAlgorithmicMedia is read from XMP and shown with its exact value.

Check an image →
AI source type declared: where this record sits inside a PNG file and what the isGenAI report says about it. The picture is a code-drawn illustration.

What a certificate tells you

The certificate’s subject gives the signer’s name, such as Adobe Inc. or OpenAI; the issuer gives the authority that vouched for that name; the validity period bounds when the signature could legitimately be made; and the chain of intermediate certificates leads to a root. C2PA requires specific key usages and recommends time-stamping so signatures remain verifiable after certificates expire. A revoked or expired certificate changes how a validator reports the manifest.

How isGenAI uses certificates

The C2PA checker verifies the signature with the certificate’s public key, walks the chain to a root, checks it against the trust list and reports the signer identity, the validation state and the trust state. A valid chain to an unknown root is reported as valid but untrusted; a broken chain or a failed signature is reported as invalid, with the validation codes listed.

Certificates versus claims

A certificate proves who signed; the claim says what they assert. isGenAI reports the signer and the assertions separately, so you can accept the identity and still read the actions critically.

Certificates also explain why some manifests from small tools appear untrusted: the developer signed with a test or self-issued certificate. The signature still proves the file is unchanged since signing; it does not tell you which organisation stands behind it.

How to use this term when checking a file

  1. Upload the original file to the AI image detector or the tool named on the page.
  2. Find the finding that uses this term under “How we checked” and read the source field it names.
  3. Weigh it by kind: a signed record, a declared field, a saved prompt and a matching copy are different strengths of evidence.
  4. Remember that absence of a record is not evidence of a human author.

See the term in a real report

Frequently asked questions

What does the certificate subject show?

The organisation that signed the manifest, as vouched for by the issuing authority.

What happens when a certificate expires?

With a trusted timestamp the signature stays verifiable for its signing time; without one, validators may report it differently. isGenAI shows the validation codes.

Can anyone get a signing certificate?

Anyone can create one, which is why trust lists exist. Only certificates chaining to accepted roots are reported as trusted.

Where do I see the signer in isGenAI?

In the C2PA checker’s manifest summary and in the AI image detector’s signed record details.

Sources

Definitions follow the published standards linked above; the isGenAI behaviour described is the deployed checker as of October 2026.