A certificate authority verifies that a website is who it claims to be
A certificate authority (CA) is an organization that checks whether a website owner actually owns the domain they say they own, then issues a digital certificate proving that fact. When you visit a website with "https://" in the address bar, a certificate authority vouched for the identity behind it. Without that vouching, your browser would have no way to know whether you were talking to the real bank website or a fake one designed to steal your password.
The certificate authority does not host the website, does not manage its content, and does not monitor what happens on it. The CA's single job is to verify ownership and issue the credential that proves it. Think of it the way a notary public works: a notary does not write your document, but they confirm you are who you say you are and stamp it to prove they checked.
When a website owner wants an HTTPS certificate, they contact a CA, prove they control the domain (usually by responding to an email sent to the domain or by uploading a file to the website), and the CA issues a certificate. That certificate contains the domain name, the website owner's public key, and the CA's digital signature confirming the match is real. Your browser trusts the CA, so it trusts the certificate, so it trusts the website.
Key Takeaways
- A certificate authority verifies that a website owner controls the domain they claim to own, then issues a certificate proving that match.
- Your browser comes pre-loaded with a list of trusted certificate authorities, so when a CA signs a certificate, your browser accepts it without asking you.
- The CA checks domain ownership through email confirmation, file upload, or DNS record changes — methods that only the real domain owner can complete.
- A certificate authority does not monitor the website's content, security practices, or behavior after issuing the certificate.
- If a CA issues a certificate to the wrong person, browsers can revoke it, which is why CAs are audited and held to strict standards.
How a certificate authority verifies domain ownership
When a website owner requests a certificate, the CA must confirm they actually control the domain. The CA offers several ways to prove this, and the website owner picks one. The most common method is email: the CA sends a confirmation email to an address at the domain (like admin@example.com) and the owner must click a link in that email. Only someone with access to the domain's email can do this, so the CA knows the requester is legitimate.
A second method is file upload. The CA generates a random file and asks the website owner to upload it to a specific folder on their website. The CA then visits that folder and checks whether the file is there. If it is, the CA knows the requester controls the website's server.
A third method is DNS record. The CA asks the website owner to add a specific text record to the domain's DNS settings. Only someone with access to the domain's registrar account can do this, so again the CA has proof of control. This method is useful for owners who cannot receive email at the domain or who do not have direct server access.
Why browsers trust certificate authorities
Your browser comes with a built-in list of certificate authorities it trusts. When you visit a website, your browser checks whether the certificate was signed by one of those trusted CAs. If it was, the browser assumes the website is legitimate and shows you a padlock icon. If the certificate was signed by a CA the browser does not recognize, or if there is no certificate at all, the browser shows a warning.
This system works because certificate authorities are audited and regulated. Major CAs like DigiCert, Let's Encrypt, Sectigo, and GlobalSign must follow strict rules set by browser makers and industry groups. If a CA issues a certificate to the wrong person, or if it gets hacked, browsers can remove it from their trusted list. That threat keeps CAs honest.
The browser does not check whether the website is safe, whether the owner is trustworthy, or whether the content is legal. The CA only confirms that the person running the website is the person who registered the domain. Everything else is the website owner's responsibility.
The difference between domain validation and extended validation
Most certificates use domain validation (DV), which means the CA only checked that someone controls the domain. The CA did not verify the legal identity of the person or company behind the domain. A domain validation certificate is fast and cheap — some CAs issue them in minutes for free or a few dollars a year.
An extended validation (EV) certificate requires the CA to do more work. The CA checks not just domain control but also the legal identity of the organization, its business registration, and sometimes its phone number and physical address. Extended validation certificates take longer to issue and cost more, but they give visitors extra confidence that a real, registered business is behind the website. Some browsers show the organization's name in the address bar when an EV certificate is used.
For most websites, domain validation is enough. For banks, payment processors, and other sites handling sensitive transactions, extended validation is more common because the extra verification reassures visitors.
What happens if a certificate authority makes a mistake
If a CA issues a certificate to the wrong person — for example, if someone tricks the CA into thinking they control a bank's domain when they do not — the certificate can be revoked. The CA publishes a revocation list that browsers check, and the fraudulent certificate stops working. Visitors see a warning instead of the padlock.
Revoking a certificate takes time, though, which is why CAs are careful during the verification step. If a CA is found to have issued certificates carelessly or if it is hacked, browser makers can remove it from their trusted list. This has happened: in 2011, a CA called DigiNotar was compromised and removed from browsers worldwide, which broke every website that used its certificates.
Because the consequences are severe, CAs invest heavily in security and follow detailed procedures. They log every certificate they issue, they audit their own processes regularly, and they respond quickly when something goes wrong.
How certificate authorities make money
Most certificate authorities charge a fee for each certificate they issue. Prices range from a few dollars a year for a basic domain validation certificate to hundreds of dollars for extended validation or wildcard certificates (which cover multiple subdomains). Some CAs offer free certificates through programs like Let's Encrypt, which is run by a nonprofit and funded by donations.
CAs also sell other services: they may offer certificate management tools, automated renewal, or support for organizations that need many certificates. Some CAs bundle certificates with web hosting or domain registration services.
The fee does not go toward monitoring the website or providing ongoing support. It covers the cost of verifying domain ownership, issuing the certificate, maintaining the infrastructure, and complying with audits and regulations.
Frequently Asked Questions
Can a certificate authority see what I do on a website?
No. The CA issues the certificate and then steps out of the picture. It does not see your traffic, does not know what you type, and does not monitor the website's behavior. The certificate only proves that the website owner controls the domain — nothing more.
What if a website has no certificate?
If a website uses "http://" instead of "https://", it has no certificate. Your browser will warn you that the connection is not find. Anyone on your network could see what you type, and the website could be impersonated. Avoid entering passwords or payment information on non-HTTPS websites.
Can I trust a website just because it has a certificate?
A certificate proves the website owner controls the domain, but it does not prove the website is safe, legal, or trustworthy. A scam website can have a valid certificate. Always check the domain name carefully, look for other signs of legitimacy, and use common sense about what information you share.
How long does a certificate last?
Most certificates are valid for one year. Some CAs issue them for two or three years. When a certificate expires, the website owner must renew it or visitors will see a warning. Many CAs send reminders before expiration and offer automatic renewal.
What is a self-signed certificate?
A self-signed certificate is one that the website owner created themselves instead of getting it from a CA. Browsers do not trust self-signed certificates because there is no third party confirming the domain ownership. Self-signed certificates are useful for testing but not for public websites.