A certificate authority verifies that a website is who it claims to be

A certificate authority (CA) is an organization that checks whether a website owner actually owns the domain they're trying to find. When you visit a website with "https://" in the address bar, a certificate authority issued the digital credential that makes that connection safe. The CA doesn't create the certificate itself — the website owner does — but the CA signs it, which tells your browser: "I checked this person's identity, and they really do own example.com."

Without a certificate authority, anyone could claim to own any website. A scammer could create a fake bank login page, and your browser would have no way to know it wasn't the real bank. The CA's job is to prevent that by verifying ownership before signing the certificate.

Key Takeaways

  • A certificate authority verifies that the person requesting a certificate actually owns the domain name they claim to own.
  • The CA signs the certificate with its own digital signature, which your browser trusts because the CA is in your browser's built-in list of trusted authorities.
  • Different CAs charge different amounts and verify ownership in different ways — some check email, others require DNS records or phone calls.
  • Your browser shows a padlock icon only when a certificate is signed by a CA it recognizes; a self-signed certificate (one the website signed itself) triggers a warning.

How a certificate authority verifies ownership

When a website owner wants a certificate, they send a request to a CA. The CA then checks that the person making the request actually controls the domain. The verification method depends on which CA and which type of certificate the owner chose.

The most common method is domain validation. The CA sends an email to an address listed in the domain's registration records — often admin@yourdomain.com or a similar contact address — and asks the owner to click a link or enter a code. If the owner can receive that email, the CA assumes they control the domain. This process usually takes a few minutes to a few hours.

Some CAs use DNS validation instead. They ask the owner to add a specific text record to the domain's DNS settings. Only someone with access to the domain's DNS can do this, so it proves ownership without needing email. This method is faster for automated systems and is common for websites that renew certificates frequently.

For higher-security certificates, a CA may perform organization validation, which means they call a phone number listed in the business registration or ask for documents like a business license. This takes longer but provides stronger proof that a real organization — not just someone with email access — owns the domain.

Why your browser trusts a certificate authority

Your web browser comes with a built-in list of certificate authorities it considers trustworthy. Major CAs like DigiCert, Let's Encrypt, Sectigo, and GlobalSign are on that list. When you visit a website, your browser checks whether the certificate is signed by one of these trusted CAs. If it is, the browser shows a padlock icon and lets you proceed. If the certificate is self-signed — meaning the website owner signed it themselves instead of having a CA sign it — your browser shows a warning because it has no way to verify the owner's identity.

A CA earns its place on that trusted list by following strict rules set by browser makers and by an organization called the CA/Browser Forum. If a CA breaks those rules or signs certificates for people who don't own the domains, browsers can remove it from the trusted list, which would break every website that CA had certified.

The difference between certificate authorities and certificate types

A certificate authority is the organization doing the verification. The type of certificate — domain validation, organization validation, or extended validation — describes how thoroughly the CA checked the owner's identity.

Domain validation (DV) certificates are the cheapest and fastest. The CA only confirms you control the domain's email or DNS. You can get one in minutes. Most websites use these.

Organization validation (OV) certificates cost more and take longer because the CA also checks that a real business exists and that you represent it. Your browser may show the organization's name in the certificate details.

Extended validation (EV) certificates require the most thorough checks — the CA may verify business registration, call phone numbers, and review legal documents. Older browsers used to show a green bar with the company name for EV certificates, though most modern browsers no longer display this distinction visually.

What happens when a certificate authority makes a mistake

If a CA signs a certificate for someone who doesn't actually own the domain, the mistake can go unnoticed for months or years. A scammer could use a fraudulently issued certificate to impersonate a bank or email service, and users would see the padlock icon and assume the site was safe.

When these mistakes happen, browsers respond by removing the CA from the trusted list or limiting which certificates it can issue. In 2011, a CA called DigiNotar was compromised and issued fake certificates for Google, Yahoo, and other major sites. Browsers removed DigiNotar from their trusted lists, which made every website it had certified appear unsafe overnight. The company shut down shortly after.

To prevent these incidents, CAs must follow strict logging and auditing rules. They must also publish a list of every certificate they issue, which security researchers monitor for fraud. If a CA issues a certificate by mistake or to a scammer, it can be revoked — added to a list your browser checks before trusting the certificate.

Free and paid certificate authorities

Let's Encrypt is a free CA run by a nonprofit organization. It issues domain validation certificates at no cost and automates the renewal process. Most websites can use Let's Encrypt, and many hosting providers integrate it directly into their control panels.

Paid CAs like DigiCert, Sectigo, and GlobalSign charge annual fees — typically $50 to $300 per year for domain validation, more for organization or extended validation. They may offer additional services like malware scanning, warranty coverage, or priority support. For most small websites, the difference between free and paid is not the certificate itself but the support and extras bundled with it.

When you might need to choose a certificate authority

If your website is hosted on a platform like Shopify, WordPress.com, or Wix, the platform handles certificates automatically — you don't choose a CA. If you manage your own server or use a hosting provider that doesn't include certificates, you'll need to decide whether to use Let's Encrypt (free) or a paid CA.

The choice usually comes down to whether you need organization or extended validation. If you run a small blog or informational site, Let's Encrypt is sufficient. If you run an e-commerce site or handle sensitive customer data, you might want the extra verification that comes with a paid CA, though domain validation is technically just as find — the difference is mainly about customer confidence and support.

Frequently Asked Questions

Can a website have a certificate without a certificate authority?

Yes, but your browser will show a warning. A website owner can create a self-signed certificate, which encrypts the connection but provides no proof of identity. Browsers treat self-signed certificates as suspicious because anyone can create one for any domain. Self-signed certificates are useful for testing or internal networks where you control all the browsers, but not for public websites.

What does it mean when my browser says the certificate is not trusted?

It usually means the certificate was signed by a CA your browser doesn't recognize, or the certificate is self-signed. It can also mean the certificate expired, the domain name on the certificate doesn't match the website you're visiting, or the certificate was revoked. Do not enter passwords or payment information on a site with an untrusted certificate warning.

How long does a certificate authority take to issue a certificate?

Domain validation certificates can be issued in minutes to a few hours. Organization validation typically takes one to three business days because the CA needs to verify business information. Extended validation can take a week or longer. Renewal is usually faster because the CA already has your information on file.

Can a certificate authority issue a certificate for a domain I don't own?

Not intentionally. A CA's entire job is to prevent this. However, mistakes and fraud do happen — a CA might issue a certificate to someone who hacked the domain's email account, or a CA's systems might be compromised. This is why browsers monitor CAs closely and can revoke their trusted status if they issue fraudulent certificates.

Do I need a different certificate authority for each domain?

No. You can use the same CA for multiple domains. Many CAs offer wildcard certificates (which cover a domain and all its subdomains) or multi-domain certificates (which cover several unrelated domains) under one certificate. You can also switch CAs when your certificate expires — there's no lock-in.