# What Is WebTrust for CAs (WebTrust audit)? Definition and Examples

> WebTrust for CAs is an audit framework in which licensed auditors check a CA's controls against CA/Browser Forum and root program requirements.

Source: https://ssl.sh/glossary/webtrust/
Last updated: 2026-11-10

WebTrust for CAs is a family of audit criteria, administered by CPA Canada, used to assess certificate authorities. Separate criteria cover general CA operations, the TLS [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/) together with network security, Extended Validation, S/MIME and code signing. Licensed practitioners issue period-of-time reports, normally covering a year, which CAs submit to root programs through the [CCADB](https://ssl.sh/glossary/ccadb/). The main alternative is an ETSI audit (EN 319 411) performed by a conformity assessment body, common among European CAs.

## Why it matters
Root programs cannot inspect every CA themselves, so they require an unbroken sequence of annual audits. A gap, a late report or a qualified opinion listing failures can lead to restrictions or [distrust](https://ssl.sh/glossary/distrust/). For certificate buyers, a CA's current audit reports are among the few objective signals of its operational discipline. Audit findings are, however, an input to root program decisions rather than the decision itself.

## Example
A typical cycle looks like this:

```text
Audit period:   12 months of CA operations
Report:         auditor's opinion on whether controls operated effectively,
                listing any exceptions found
Disclosure:     CA uploads the report to the CCADB
Review:         root programs read it alongside the CA's incident reports
```

## Common misconceptions
- **A WebTrust seal means a website is safe.** The audit concerns the CA's operations, not the sites that use its certificates.
- **Passing the audit means the CA had no problems.** Reports can be qualified and list exceptions, and root programs also weigh incidents outside the audit.
- **WebTrust is the only accepted audit.** ETSI-based audits are also accepted by the major root programs.

## Related terms

- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。
- [根证书计划](https://ssl.sh/zh/glossary/root-program/): 根证书计划是浏览器或操作系统厂商用来决定其信任库收录、限制或移除哪些根 CA 的政策与流程。
- [CCADB](https://ssl.sh/zh/glossary/ccadb/): CCADB 是通用 CA 数据库，CA 在这里向各根证书计划披露其根证书、中间证书、审计报告、政策文件和 CRL 地址。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。
- [CA/B 论坛](https://ssl.sh/zh/glossary/ca-browser-forum/): CA/B 论坛是证书颁发机构与浏览器厂商组成的自愿性行业组织，负责制定公开信任证书必须遵守的基线规则。