Certificate Authorities
How a Certificate Authority Verifies and Signs
A certificate authority (CA) is a trusted organization that checks a certificate applicant's identity and then signs the certificate. The signature tells browsers that the CA vouches for the link between the named domain and the public key inside the certificate.
The process starts with a certificate signing request (CSR), a message that contains the applicant's public key and the names to be covered. The CA then checks that the applicant controls the domain, along with any organization details that the required validation level demands. Only after those checks does the CA sign the certificate with its own private key.
Browsers and operating systems decide which CAs to trust. Browser makers and operating system vendors maintain root programs, which are lists of CA root certificates they accept. Each CA in those lists must pass audits and follow the baseline requirements published by the CA/Browser Forum, an industry group whose members include browser makers and certificate issuers.
What Happens When a CA Loses Trust
Trust in a CA is delegated, so it can be withdrawn. If a CA issues certificates to people who did not control the domain, or fails to follow the rules, browser makers can remove it from their trust stores or distrust its root certificate.
When that happens, certificates the CA issued stop working in those browsers, even if they have not expired. Several well-known CAs have been distrusted over the years, and site owners using their certificates had to obtain replacements quickly. For this reason, a CA's track record matters, not just its brand name.
Certificates reach browsers through a chain that leads back to the CA's root, explained in the chain of trust article. Public CAs also record the certificates they issue in public logs, which is the subject of certificate transparency.
Example: A Private CA on a Company Network
A company may run its own CA for internal websites and tools. It installs that CA's root certificate on every employee computer, so the internal certificates work without warnings. A visitor from the public internet, whose browser does not have that root, sees a certificate error for the same site. This shows how a private CA works: its certificates are trusted only where someone has deliberately added its root.
Frequently asked questions
Who operates certificate authorities?
Public CAs are run by commercial companies and nonprofit organizations. Their root certificates are included in browser and operating system trust stores only after they pass audits and meet the requirements set by browser makers and the CA/Browser Forum. Companies and institutions may also run private CAs, which are trusted only inside their own networks.
Can I become a certificate authority?
You can create a private CA for your own devices or network, but public browsers will not trust it unless its root is installed on each device. Public trust requires a root certificate accepted into major trust stores, which involves a formal audit process. For a public website, a certificate from an existing public CA is the practical route.