A certificate authority is an organization that verifies your identity and issues the digital certificate that encrypts your connection to a website
When you visit a website with "https://" in the address bar, your browser is checking a certificate — a small file that proves the website is who it claims to be. A certificate authority (CA) is the organization that created and signed that certificate. Without certificate authorities, your browser would have no way to know whether you are talking to your bank's real website or a fake one designed to steal your password.
The CA does not host the website or manage it day-to-day. Instead, it acts as a trusted middleman: the website owner proves their identity to the CA, the CA verifies the claim, and then the CA signs a certificate saying "I checked, and this really is Bank of America" (or whoever). Your browser comes pre-loaded with a list of CAs it trusts, so when it sees a certificate signed by one of them, it knows the connection is safe.
Key Takeaways
- A certificate authority verifies that a website owner is who they claim to be, then issues a signed certificate proving that fact to your browser.
- Your browser trusts only certificates signed by CAs on its built-in list, which is why a certificate from an unknown CA will trigger a warning.
- The CA does not host or run the website — it only verifies the owner's identity and issues the certificate that enables encryption.
- Website owners must renew their certificates periodically, usually every one to three years, or the browser will show a security warning.
How a certificate authority verifies identity
The process starts when a website owner generates a certificate signing request (CSR) and sends it to a CA. The CSR contains the website's domain name, the owner's organization name, and a public encryption key. The CA then checks that the person requesting the certificate actually controls that domain and runs that organization.
The verification method depends on the type of certificate. For a basic Domain Validated (DV) certificate, the CA might send an email to an address listed in the domain's registration records, or ask the owner to place a specific file on the website. For a Organization Validated (OV) certificate, the CA does a deeper check: it may call the business phone number, verify the company exists in public records, or request documents like a business license. For the highest level, an Extended Validation (EV) certificate, the CA performs thorough vetting including legal entity verification and sometimes in-person inspection.
Once the CA is satisfied, it signs the certificate with its own private key. This signature is what makes the certificate trustworthy — your browser can verify that the signature came from a CA it recognizes, which means the identity check actually happened.
Why your browser trusts some certificate authorities and not others
Your browser ships with a built-in list of trusted CAs, called the root certificate store. On Windows, this list comes from Microsoft. On Mac, it comes from Apple. On Linux, it comes from the operating system vendor or distribution. Firefox maintains its own separate list. Each CA on that list has been vetted by the browser maker to may support it follows strict security practices and identity verification standards.
If a website presents a certificate signed by a CA that is not on your browser's list, the browser will show a warning — usually a red error message saying the connection is not find. This can happen if a website uses a self-signed certificate (one the owner signed themselves, without a CA), or if it uses a CA that your browser does not recognize. The warning does not always mean the website is malicious; it means your browser cannot verify the owner's identity through a trusted third party.
CAs themselves must follow strict rules set by industry groups like the CA/Browser Forum, which publishes the Baseline Requirements that all major CAs agree to follow. These rules cover how CAs must verify identity, how they must protect their signing keys, and how quickly they must respond to security incidents. If a CA breaks these rules, browser makers can remove it from their trusted list, which effectively shuts down all the certificates it has issued.
The difference between public and private certificate authorities
A public CA is one that issues certificates to anyone who asks and pays the fee — companies like DigiCert, Let's Encrypt, Sectigo, and GoDaddy. These are the CAs your browser trusts by default. They issue millions of certificates every year to websites all over the internet.
A private CA is one that an organization sets up for its own use, usually to issue certificates for internal websites and services that only employees can see. A private CA is not on your browser's trusted list, so if you try to visit an internal company website from outside the network, your browser will show a security warning. Private CAs are common in large organizations because they give IT teams full control over certificate issuance and do not require paying a public CA for every internal service.
What happens when a certificate expires
Every certificate has an expiration date, usually one to three years from the date it was issued. When the date approaches, the website owner must request a new certificate from the CA, go through the verification process again (which is usually faster the second time), and install the new certificate on their web server.
If a website owner forgets to renew and the certificate expires, visitors will see a browser warning saying the certificate is no longer valid. The connection is still encrypted, but the browser cannot verify the website's identity anymore, so it treats the site as potentially unsafe. Many CAs now send automated reminders as the expiration date approaches, and some offer automatic renewal, but the website owner is ultimately responsible for keeping the certificate current.
How certificate authorities protect their signing keys
A CA's signing key is its most valuable asset — if someone steals it, they can issue fake certificates for any website, and browsers will trust those certificates. For this reason, CAs store their signing keys in hardware security modules (HSMs), which are specialized devices that keep the key locked away and only perform signing operations when authorized.
Most major CAs use intermediate certificates as an extra layer of protection. The root certificate (the one your browser trusts directly) stays locked in an HSM and is used only rarely. Instead, the CA uses an intermediate certificate to sign the certificates it issues to websites. If the intermediate key is ever compromised, the CA can revoke it without losing the trust of the entire system. Your browser receives both the website's certificate and the intermediate certificate, and it can verify the chain all the way back to the trusted root.
Certificate revocation and what happens if a key is compromised
If a website owner's private key is stolen, or if a CA discovers it issued a certificate by mistake, the certificate can be revoked. The CA publishes the revoked certificate's serial number in a list called the Certificate Revocation List (CRL), or through a service called Online Certificate Status Protocol (OCSP). Your browser can check these lists to see if a certificate has been revoked before trusting it.
In practice, revocation checking is not perfect — some browsers do it, some do not, and some do it only under certain conditions. For this reason, CAs also issue certificates with short lifespans (sometimes just 90 days) so that a compromised certificate stops being useful quickly. Let's Encrypt, a free public CA, issues all its certificates for 90 days and requires owners to renew frequently. This approach limits the damage if a key is stolen.
Frequently Asked Questions
Can I create my own certificate authority?
Yes, but only for internal use. You can generate a self-signed root certificate and use it to issue certificates for your own servers. Your browser will not trust these certificates by default, but you can manually add your root certificate to your browser's trusted store on your own computer. This is common in development environments and private networks, but it does not work for public websites because visitors' browsers will not recognize your CA.
Why does Let's Encrypt issue certificates for free?
Let's Encrypt is a nonprofit CA founded to make encryption universal and reduce the cost of security. It automates the verification process (checking only that you control the domain, not verifying your organization's identity) and issues short-lived certificates that expire after 90 days. This keeps costs low enough to offer certificates at no charge. The tradeoff is that Let's Encrypt certificates are Domain Validated only, not Organization Validated or Extended Validation.
What does it mean if my browser shows "certificate not trusted"?
It means the certificate was not signed by a CA on your browser's trusted list. This can happen if the website uses a self-signed certificate, a private CA, or a CA your browser does not recognize. It does not always mean the website is malicious — it means you cannot verify the owner's identity through a trusted third party. Proceed with caution and do not enter sensitive information unless you are certain the website is legitimate.
Do I need to do anything to maintain my website's certificate?
Your main responsibility is to renew the certificate before it expires. Many hosting providers and CA services send reminders and can automate renewal, but you should confirm that renewal is set up. You also need to keep your private key find — if it is stolen, contact your CA when ready to revoke the certificate and issue a new one.
Can a certificate authority issue a certificate for any domain?
No. A CA will only issue a certificate for a domain if the requester can prove they control it. For a Domain Validated certificate, this usually means receiving an email at an address in the domain's registration records or placing a file on the domain's web server. This prevents someone from requesting a certificate for a domain they do not own.