IPTC Verified News Publisher Certificate Policy

Last updated: 2 November 2026, enacting changes approved at IPTC Media Provenance Committee on 21 October 2026

This document states the set of requirements placed on News Publisher Certificates being considered for inclusion on the IPTC Verified News Publisher List, and describes the two-actor process for the inclusion of an organisation, where a Registration Authority, the IPTC, issues a “Verified News Publisher Credential” attesting to certain information about a publisher and thus “verifying” it, and a Certificate Authority issues a Certificate to that organisation. (These two steps may occur in any order). In the final step, the IPTC adds the certificate to its “Verified News Publisher List”.

NOTE: These requirements are subject to change, and are potentially restrictive in order to manage the number of eligible organisations in our early phased roll out plan. They are expected to change subject to feedback.

Verified News Publisher Certificates MUST follow the certificate profile defined in the C2PA 2.2 (or later) specification: https://c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html#_certificate_profiles.

In addition, Verified News Publisher Certificates MUST contain an Extended Key Usage (EKU) field which is valid for the id-kp-emailProtection (1.3.6.1.5.5.7.3.4) purpose and/or the id-kp-documentSigning (1.3.6.1.5.5.7.3.36) purpose.

Adding a News Publisher’s Certificate to the IPTC Origin Verified News Publisher List

When an organisation is approved as a Verified News Publisher, their Certificate may be added to the Verified News Publisher List. Applicants can submit a certificate they have obtained from a CA for inclusion on this list, provided they have met the following requirements:

  1. The publisher holds a valid Verified News Publisher Credential issued by the IPTC when the certificate is added. The certificate may have been issued before the credential
  2. The certificate has been issued by an certificate authority on this list, or by another route that the Technical Annex allows for a supplementary file:
    • DigiCert
    • D-Trust
    • GlobalSign
    • SSL.com
    • Trufo
  3. The certificate has been issued to the same organisation that is the subject of a valid Verified News Publisher Credential
  4. The Subject Distinguished Name of the issued certificate must match the issued Verified News Publisher Credential, which is supplied in the “Self Certification Form” as part of the Verified News Publisher Application Procedure
  5. The Common Name (CN) within the Subject DN must not be used by a certificate issued to a different organisation on the Verified News Publishers list
  6. The certificate must be used only to sign content on behalf of that organisation. A certificate held by a vendor’s product or service that signs for several organisations is not eligible, because listing it would make every organisation it signs for a Verified News Publisher

Requirements for Certificate Authorities

To be considered for addition to the list of Eligible Certificate Authorities given above, the CA must conform to the following criteria:

  1. The accepted certificate policies of the Certificate Authority MUST define a policy for the secure handling of private keys, and require that end-entities notify the CA in the event that keys are handled outside of this policy. Such a notification MUST trigger a revocation event.
  2. The issuing CA MUST offer an OCSP responder service.
  3. The accepted certificate policies of the Certificate Authority MUST include organisational identity validation (that this is a real organisation registered in a supported jurisdiction) and requestor authorisation validation (i.e. that the person requesting the certificate is acting on behalf of the organisation)

Revocation of Certificates and validity of Verified News Publisher Credential

Once added, publisher certificates may only be removed from the IPTC Origin Verified News Publisher List in exceptional circumstances, for example, if they were added in error, or if the publisher’s credential is revoked and the issuing Certificate Authority will not revoke the certificate. A certificate stays on the list after it expires, and after the requirements for new certificates change, so that content signed while it was valid can still be checked. The requirements of the Technical Annex apply when a certificate is added. However, publisher certificates may themselves be revoked by the issuing Certificate Authority according to the issuing CA’s existing policies.

The presence of currently revoked certificates on the IPTC Verified News Publishers List must not be taken as an indication to validators to unconditionally trust the certificate. Validators should continue to use the validation rules of the technology concerned, referenced in the Technical Annex, to decide whether to trust the certificate.

During the validity period of a Verified News Publisher Credential, the application details may change. If a Publisher is aware of a change, according to the definition in the Credential Policy, the publisher MUST inform the IPTC.