A certificate authority, commonly abbreviated CA, is a trusted entity that issues and digitally signs certificates binding public keys to specified subjects under defined validation procedures and policies. Certificate authorities are a central component of many public-key infrastructure systems. When a CA signs a certificate, it is making a cryptographic statement that the certificate contents were issued under its authority and according to its rules.
A browser or operating system can then decide whether to trust that CA and whether the particular certificate satisfies the relevant validation requirements. A CA is therefore not simply a database of certificates and is not itself the same thing as a certificate. It is an authority within a trust system responsible for certificate issuance and related lifecycle functions.
The need for certificate authorities arises from the difficulty of establishing trust across large networks. Public-key cryptography allows users to exchange public keys, but a recipient needs a way to determine whether a public key genuinely belongs to the claimed website, person, organisation or device. A CA provides an intermediary trust mechanism. Instead of every browser needing a direct pre-existing relationship with every website, browsers can trust a set of recognised root CAs and accept certificates issued through authorised chains. This is a hierarchical trust model. The approach allows millions of identities to be authenticated using a comparatively manageable collection of trust anchors, although it also means that compromise or misuse of a trusted CA can have consequences across many relying parties.
Publicly trusted CA systems generally use a hierarchy consisting of root CAs, intermediate CAs and end-entity certificates. Root CAs are trust anchors and are often kept offline or under particularly stringent controls. Root CAs may issue intermediate CA certificates rather than routinely signing website certificates directly. Intermediate CAs can then issue certificates to websites, services or other subjects within defined constraints. The resulting chain allows a client to verify that an end-entity certificate ultimately descends from a trusted root. Basic constraints, key-usage extensions and path-length restrictions can limit what subordinate authorities are permitted to do. This hierarchy supports operational separation and reduces the need to expose highly sensitive root signing keys during routine certificate issuance.
Before issuing a certificate, a CA performs validation appropriate to the certificate type and applicable rules. For domain certificates, validation may involve demonstrating control over a domain through DNS records, HTTP resources or email mechanisms. More extensive certificate profiles can involve organisational identity checks. Internal enterprise CAs may use entirely different procedures based on corporate identity systems and device-management infrastructure. The CA's validation process determines what assertion the resulting certificate supports.
A certificate should therefore not be interpreted as proving more than the issuing policy and validation method establish. The technical signature demonstrates that the CA issued the certificate; the substantive trust depends on how carefully the CA verified the subject and how relying systems interpret that certificate.
Certificate authorities also participate in certificate lifecycle management. Certificates have validity periods and may need renewal before expiration. A certificate can be revoked if its private key is compromised, if the certificate was issued incorrectly or if another defined revocation condition occurs. Revocation can be communicated using certificate revocation lists and OCSP, although implementation and browser behaviour vary. CAs may also support automated issuance and renewal protocols such as ACME, which is widely used for automated TLS certificate management. Automation reduces administrative effort and helps prevent outages caused by expired certificates, but automated issuance systems must themselves be protected against unauthorised domain validation or account compromise.
CA security is critical because a malicious or compromised CA may be able to issue certificates that clients accept as authentic for domains or other identities within its authority. Public CA ecosystems therefore impose technical, procedural and auditing requirements. Root keys are protected with strong physical and logical controls, often involving hardware security modules and carefully controlled ceremonies. Certificate transparency provides additional public visibility for many internet-facing certificates, allowing domain owners and researchers to identify unexpected issuance. Browsers and operating-system vendors maintain trust stores and can remove or distrust problematic CA certificates when serious issues arise. These mechanisms demonstrate that trust in a CA is not solely a cryptographic property; it is supported by governance, auditing, operational controls and ecosystem oversight.
Certificate authorities can be public or private. Public CAs issue certificates intended to be trusted broadly, subject to ecosystem requirements. Private or enterprise CAs are controlled by organisations for internal purposes such as employee authentication, device identity, internal TLS and secure service-to-service communication. An enterprise can install its private root certificate into managed devices so that internal certificates are trusted without requiring public issuance. Private PKI provides substantial control but creates responsibilities for operating root and intermediate authorities, protecting keys, issuing certificates correctly and maintaining trust stores. A certificate issued by a private CA is not automatically trusted by the public internet simply because it is technically valid.
A CA should be distinguished from a registration authority, certificate repository and PKI as a whole. A registration authority may perform identity verification or approval functions on behalf of a CA, while the CA performs cryptographic certificate issuance. A repository stores or publishes certificates and related information but does not necessarily establish trust. PKI encompasses the broader policies, infrastructure, software, certificates, authorities and lifecycle processes. The most important practical concept is that a CA is a trust anchor or subordinate trust authority within a defined ecosystem. Its certificate signatures are meaningful only to parties that choose to trust that authority and follow appropriate certificate-validation rules.
