IPTC Verified News Publisher Certificate Policy

Last updated: 16 December 2024, enacting changes approved at IPTC Media Provenance Committee on 10 December 2024

This document states the set of requirements placed on News Publisher Certificates being considered for inclusion on the IPTC Verified News Publisher List, and describes the two-actor process for the inclusion of an organisation, where a Registration Authority, the IPTC, issues a “Verified News Publisher Credential” attesting to certain information about a publisher and thus “verifying” it, and a Certificate Authority issues a Certificate to that organisation. (These two steps may occur in any order). In the final step, the IPTC adds the certificate to its “Verified News Publisher List”.

NOTE: These requirements are subject to change, and are potentially restrictive in order to manage the number of eligible organisations in our early phased roll out plan. They are expected to change subject to feedback.

Verified News Publisher Certificates must follow C2PA 2.1 specification requirements, found here: https://c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html#x509_certificates.

The C2PA specification allows for the use of the emailProtection and documentSigning EKUs, however, certificates intended for inclusion on the Verified News Publisher list must include the id-kp-documentSigning (1.3.6.1.5.5.7.3.36) EKU.

Adding a News Publisher’s Certificate to the IPTC Origin Verified News Publisher List

When an organisation is approved as a Verified News Publisher, their Certificate may be added to the Verified News Publisher List. Applicants can submit a certificate they have obtained from a CA for inclusion on this list, provided they have met the following requirements:

  1. The publisher has been accepted for a Verified News Publisher Credential issued by the IPTC, and the certificate’s validity period starts before or at the same time as the VNP Credential, and ends before or at the same time as the VNP Credential
  2. The certificate has been issued by an certificate authority this list, and is issued with the certificate policies listed under each:
  3. The certificate has been issued to the same organisation that is the subject of a valid Verified News Publisher Credential
  4. The Subject Distinguished Name of the issued certificate must match the issued Verified News Publisher Credential, which is supplied in the “Self Certification Form” as part of the Verified News Publisher Application Procedure

Requirements for Certificate Authorities

To be considered for addition to the list of Eligible Certificate Authorities given above, the CA must conform to the following criteria:

  1. The accepted certificate policies of the Certificate Authority MUST define a policy for the secure handling of private keys, and require that end-entities notify the CA in the event that keys are handled outside of this policy. Such a notification MUST trigger a revocation event.
  2. The issuing CA MUST offer an OCSP responder service.
  3. The accepted certificate policies of the Certificate Authority MUST include organisational identity validation (that this is a real organisation registered in a supported jurisdiction) and requestor authorisation validation (i.e. that the person requesting the certificate is acting on behalf of the organisation)

Revocation of Certificates and validity of Verified News Publisher Credential

Once added, publisher certificates may only be removed from the IPTC Origin Verified News Publisher List in exceptional circumstances, for example, if they were added in error. However, publisher certificates may themselves be revoked by the issuing Certificate Authority according to the issuing CA’s existing policies.

The presence of currently revoked certificates on the IPTC Verified News Publishers List must not be taken as an indication to validators to unconditionally trust the certificate. Validators should continue to use the validation rules defined in the C2PA Content Credentials specification to decide whether to trust the certificate.

During the validity period of a Verified News Publisher Credential, the application details may change. If a Publisher is aware of a change, according to the definition in the Credential Policy, the publisher MUST inform the IPTC.