# What Is Certificate Authority (CA)? Definition and Examples

> Certificate Authority (CA) is an organization that validates certificate requests and signs certificates binding public keys to domain names or identities.

Source: https://ssl.sh/glossary/certificate-authority/
Last updated: 2026-11-10

A certificate authority is the issuer in a [PKI](https://ssl.sh/glossary/pki/): it checks that an applicant controls a domain (and, for OV and EV, that the organization exists), then signs a certificate with one of its CA keys. Public CAs operate [root certificates](https://ssl.sh/glossary/root-certificate/) that browsers and operating systems ship in their trust stores, and they issue end-entity certificates from intermediate CAs beneath those roots.

## Why it matters
A browser trusts a certificate only if it chains to a root in its trust store, so every publicly trusted CA can, in principle, issue for any domain. That power is controlled by root programs (Mozilla, Chrome, Apple, Microsoft), the CA/Browser Forum [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/), regular audits, Certificate Transparency and CAA records. CAs that break the rules lose trust: Chrome 70 (October 2018) distrusted the old Symantec PKI entirely, and Chrome 131 and later distrust Entrust TLS certificates whose earliest SCT is after 2024-11-11.

## Example
Domain owners can restrict which CAs may issue for them with a CAA record:

```bash
dig +short CAA example.com
# 0 issue "letsencrypt.org"
```

## Common misconceptions
- **A more expensive CA gives stronger encryption.** All public CAs issue certificates with the same algorithms; price reflects validation level, warranty and support.
- **The CA holds my private key.** In a normal CSR workflow the CA only sees your public key; the private key never leaves your server.
- **The company that sold me the certificate is the CA.** Many hosting panels and vendors are resellers; the certificate's issuer field shows the CA that actually signed it.

## Related terms

- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。
- [中间证书](https://ssl.sh/zh/glossary/intermediate-certificate/): 中间证书是由根证书（或上级中间证书）签发、用来签发网站证书的 CA 证书，服务器必须把它和网站证书一起发送给客户端。
- [根证书计划](https://ssl.sh/zh/glossary/root-program/): 根证书计划是浏览器或操作系统厂商用来决定其信任库收录、限制或移除哪些根 CA 的政策与流程。
- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。
- [CA/B 论坛](https://ssl.sh/zh/glossary/ca-browser-forum/): CA/B 论坛是证书颁发机构与浏览器厂商组成的自愿性行业组织，负责制定公开信任证书必须遵守的基线规则。
- [取消信任](https://ssl.sh/zh/glossary/distrust/): 取消信任是根证书计划作出的决定：不再信任某家 CA 的证书，可能是全部证书，也可能只针对截止日期之后签发的证书。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。
- [PKI](https://ssl.sh/zh/glossary/pki/): PKI 即公钥基础设施，指用于签发、分发、验证和吊销数字证书的一整套角色、策略、软件和操作流程。