# What Is Private CA (Internal CA, enterprise CA)?

> Private CAs are certificate authorities that an organization runs for its own systems, trusted only on devices where it installs the root.

Source: https://ssl.sh/glossary/private-ca/
Last updated: 2026-11-10

A private CA issues certificates outside the public Web PKI. Its [root certificate](https://ssl.sh/glossary/root-certificate/) is not in browser or operating-system trust stores, so the organization distributes it itself, for example through device management, container images or configuration management. Common implementations include Microsoft Active Directory Certificate Services, AWS Private CA, the PKI secrets engine in HashiCorp Vault, smallstep step-ca and plain OpenSSL scripts.

## Why it matters
Publicly trusted CAs issue only for publicly resolvable domain names and public IP addresses; they no longer issue for internal names such as `db.corp` or private addresses such as `10.0.0.5`. A private CA fills that gap and is the usual choice for [mTLS](https://ssl.sh/glossary/mtls/) between microservices, VPN and Wi-Fi client certificates, and device identity. It is also outside CA/Browser Forum rules, so you choose lifetimes, key types and EKUs, which matters now that public TLS certificates are losing the clientAuth EKU. The trade-off is that key protection, revocation and root rotation become your responsibility.

## Example
```text
Internal Root CA (offline, distributed to company devices)
 └─ Internal Issuing CA (online, automated via ACME or an API)
     ├─ api.internal.example.com (server certificate)
     └─ payments-service (client certificate for mTLS)
```

## Common misconceptions
- **A private CA is the same as a self-signed certificate.** A private CA is a hierarchy that can issue and revoke many certificates; trusting its root once covers all of them, unlike trusting individual [self-signed certificates](https://ssl.sh/glossary/self-signed-certificate/).
- **Private CAs are insecure.** Their security depends on how keys and processes are run; a well-operated private CA is standard enterprise practice.
- **A private CA can secure a public website.** Visitors' browsers will not trust it unless they install your root.

## Related terms

- [PKI](https://ssl.sh/zh/glossary/pki/): PKI 即公钥基础设施，指用于签发、分发、验证和吊销数字证书的一整套角色、策略、软件和操作流程。
- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。
- [信任库](https://ssl.sh/zh/glossary/trust-store/): 信任库是操作系统、浏览器或编程语言运行时内置的一组根 CA 证书，验证证书链时以它们作为信任锚。
- [mTLS](https://ssl.sh/zh/glossary/mtls/): mTLS 是服务器和客户端在握手中都用 X.509 证书向对方证明身份的 TLS，也叫双向 TLS 认证。
- [客户端证书](https://ssl.sh/zh/glossary/client-certificate/): 客户端证书是 TLS 客户端在握手时出示、用来向服务器证明自身身份的 X.509 证书。
- [自签名证书](https://ssl.sh/zh/glossary/self-signed-certificate/): 自签名证书是用自身私钥签名的证书，颁发者与主体相同，没有任何 CA 为它担保。
- [名称约束](https://ssl.sh/zh/glossary/name-constraints/): 名称约束是 CA 证书中的 X.509 扩展，用来限定该 CA 之下签发的证书只能包含哪些域名、IP 段、邮箱或 DN。