验证
申请证书
XENLOOK C2PA验证

试点·C2PA 审核中 · 韩国 2027.03 · 日本 2027.06 · 模范法为韩国法

版权 C-2026-036487 · 专利申请 10-2026-0100026（尚未注册）

法律与政策 →
Course contents
Chapter 5 of 10

Chapter 5Trust links together like a chain

Even with a signature, whether you can trust the signer is a separate question. In this chapter you learn the trust chain that runs from a top authority to an issuing authority to an individual certificate, and how to look up whether a certificate has been revoked. You also review chapters 1 to 4.

  • Official session name · Learning PKI and CA structure, and a standards check
  • 5 practice steps
  • You can follow along without signing in
What you will learn in this chapter
  • You know the three links of the trust chain.
  • You know when a certificate is revoked, and how to look up whether it was.
  • You know that “signature valid” and “trusted” are not the same thing.

The idea in plain words

It works like a company ID badge
Head office recognizes a branch, and the branch gives staff their ID badges. If a badge looks doubtful, you check the branch. If the branch looks doubtful, you check head office. When someone leaves, the badge is taken back and the name is struck from the entry list. Certificates link upward in the same way, and are revoked when something goes wrong.

A certificate is a document that says, “The owner of this public key is this person.” A certificate authority (CA) signs that document.

The certificate authority is itself recognized by a higher authority (a root CA). That gives you a chain: top authority, then issuing authority, then individual certificate.

A checking program follows the chain all the way up. It looks at whether the chain reaches a top authority on a list of authorities it has already agreed to trust (the Trust List). If it does, the result is “trusted.” If it does not, the result is “not trusted.”

So even if a signature is mathematically correct (signature valid), the result can still be “not trusted” when the top authority is not on the list. This site's pilot certificate authority is in that state right now.

If a secret key is lost or a certificate was issued by mistake, the certificate is revoked. The list of revoked certificates is called a CRL. The window where you ask about the status of one certificate directly is called OCSP.

A certificate also has a validity period. A signature made with an expired certificate is shown as a problem by some checkers. You will see an example of this yourself in chapter 8.

See the picture

  1. Top authorityroot CA
  2. Issuing authorityintermediate CA
  3. Individual certificatethe signer
  4. Signed filemanifest
A check goes from the bottom up. Only when the top authority is on the Trust List is the result “trusted.”

Try it yourself

Work from the top, one step at a time. After each step, check that your screen matches “What you should see.”
  1. In the Trust & compliance group, open the public repository page. Find the link to the certificate revocation list (CRL) and the notes on OCSP.
    What you should see You see the CRL address (/api/ca/v1/crl) and the OCSP entry, “OCSP-style status (serial required).”
    Open the public repositoryNo sign-in
  2. Download the CRL file. All you need to check is that it is a file for programs to read, not text for people.
    What you should see The file downloads, and when you open it you see symbols that are hard to read. That is normal.
    Download the CRLNo sign-in
  3. On the developers page, find the OCSP lookup (GET /api/ca/v1/ocsp/{serial}). You enter a certificate's serial number in hexadecimal, and it tells you the status.
    What you should see The OCSP address and how to use it appear under “Verify OCSP-style status.”
    Open the developers pageNo sign-in
  4. With your mentor, look up the status of one real certificate through OCSP.
    What you should see One of good, revoked or unknown comes back.
    With your mentor
  5. Answer the review questions for chapters 1 to 4 again. Write any you got wrong or found confusing in your practice log.
    What you should see You can answer every review question from chapters 1 to 4 in your own words.
    Go to the course contentsNo sign-in
The part you do with your mentor · Your PKI mentor explains what this site's trust chain looks like, and why it is not on the Trust List for now, so other checkers show “not trusted.”

Check your work

If you can answer “yes” to everything below, you have finished this chapter.
  • Can you say the three links of the trust chain from the top down?
  • Can you say what CRL and OCSP each are?
  • Can you explain why “signature valid” and “trusted” are different?

Easy to mix up

  • Common misunderstandingIf the signature is valid, the signer can be trusted.
    What is actually trueSignature valid means it is mathematically correct. Whether you can trust the signer is a separate check: does the trust chain reach the Trust List?
  • Common misunderstandingA certificate, once issued, stays valid forever.
    What is actually trueIt has a validity period, and it can be revoked before that period ends if something goes wrong.

Review questions

  1. Question 1Say the three links of the trust chain from the top down.Show answerHide answer
    Top authority (root CA), then issuing authority (intermediate CA), then individual certificate.
  2. Question 2What should happen to a certificate whose secret key was lost?Show answerHide answer
    It should be revoked. A revoked certificate is added to the CRL, and an OCSP lookup returns “revoked.”
  3. Question 3A file signed with this site's certificate shows “not trusted” in another checker. Why?Show answerHide answer
    This site's pilot certificate authority is not yet on the C2PA Trust List. It does not mean the signature itself is wrong.

Key terms

Certificate authorityCA
The organization that issues certificates and signs them.
Root CA
The top authority at the very top of a trust chain.
Trust List
The list of top authorities that a checking program has agreed to trust.
CRLcertificate revocation list
A list that collects the revoked certificates.
OCSPOnline Certificate Status Protocol
A way to ask directly about the status of one certificate.

Practice log

Print it and write by hand, or copy the same items into a document. Once your mentor has checked it, you are done.
Chapter 5 practice logTrust links together like a chain
Practice date
Written by
Mentor check
  1. A drawing of the trust chain (draw the three links yourself)
  2. The CRL address and the OCSP notes you found in the public repository
  3. The result of the OCSP lookup you did with your mentor
  4. What was confusing in the review of chapters 1 to 4
  5. The difference between “signature valid” and “trusted,” in your own words