Certificate Authority (CA)

A certificate authority is the issuer in a PKI: it checks that an applicant controls a domain (and, for OV and EV, that the organization exists), then signs a certificate with one of its CA keys. Public CAs operate root certificates that browsers and operating systems ship in their trust stores, and they issue end-entity certificates from intermediate CAs beneath those roots.

Why it matters

A browser trusts a certificate only if it chains to a root in its trust store, so every publicly trusted CA can, in principle, issue for any domain. That power is controlled by root programs (Mozilla, Chrome, Apple, Microsoft), the CA/Browser Forum Baseline Requirements, regular audits, Certificate Transparency and CAA records. CAs that break the rules lose trust: Chrome 70 (October 2018) distrusted the old Symantec PKI entirely, and Chrome 131 and later distrust Entrust TLS certificates whose earliest SCT is after 2024-11-11.

Example

Domain owners can restrict which CAs may issue for them with a CAA record:

dig +short CAA example.com
# 0 issue "letsencrypt.org"

Common misconceptions

• A more expensive CA gives stronger encryption. All public CAs issue certificates with the same algorithms; price reflects validation level, warranty and support.
• The CA holds my private key. In a normal CSR workflow the CA only sees your public key; the private key never leaves your server.
• The company that sold me the certificate is the CA. Many hosting panels and vendors are resellers; the certificate's issuer field shows the CA that actually signed it.