A certificate authority is an organization that verifies a website's identity and issues the digital certificate that makes HTTPS connections possible
When you visit a website with a green lock icon in your browser, a certificate authority (CA) vouched for that site's identity. The CA checked who owns the domain, confirmed they control it, and then issued a digital certificate — a file that proves the site is what it claims to be. Without this verification step, your browser would have no way to know whether you are talking to the real bank website or a fake one designed to steal your password.
The certificate itself is just data. The CA's role is to stand behind that data and say: "I checked this organization. I confirmed they own this domain. I issued this certificate on this date." Your browser trusts the CA, so it trusts the certificate, so it trusts the connection.
Key Takeaways
- A certificate authority verifies that a website owner controls the domain before issuing a certificate, preventing imposters from creating fake versions of real sites.
- Your browser comes pre-loaded with a list of trusted CAs; if a certificate comes from one of those CAs, the browser shows the green lock and allows the encrypted connection.
- CAs range from large companies like DigiCert and Sectigo to smaller regional authorities, but all follow the same verification rules set by industry standards.
- A certificate is only as trustworthy as the CA that issued it, which is why browsers reject certificates from unknown or untrusted authorities.
How a certificate authority verifies a website owner
The verification process depends on the type of certificate being issued. For a domain validation (DV) certificate, the CA sends an email to the domain owner's registered contact address or places a verification file on the website. If the person requesting the certificate can receive that email or upload that file, the CA assumes they control the domain. This process takes hours to days.
For an organization validation (OV) certificate, the CA does more work. It checks business records, calls the company's phone number, and confirms that the person requesting the certificate actually works there. This takes days to weeks and costs more money.
For an extended validation (EV) certificate, the CA performs the deepest check: verifying the company's legal existence, ownership structure, and authority of the person signing the request. Some browsers used to show a special green bar for EV certificates, though most have stopped doing this. The process can take weeks.
In all cases, the CA is not checking whether the website is safe or trustworthy in a moral sense. It is only confirming: "This person controls this domain." A phishing site can get a DV certificate if the attacker controls the domain they registered.
Why your browser trusts certain certificate authorities
Your browser ships with a built-in list of trusted CAs — usually 50 to 100 of them. These are organizations like DigiCert, Sectigo, GlobalSign, and Let's Encrypt. When a website presents a certificate, your browser checks: Did one of my trusted CAs issue this? If yes, the lock turns green. If no, the browser shows a warning.
Getting on that trusted list is not automatic. A CA must meet strict security standards set by the CA/Browser Forum, an industry group that includes browser makers and CAs. The standards cover how the CA stores its private keys, how it verifies identities, how it responds to security breaches, and how often it audits itself. A CA that fails these standards gets removed from browsers, which destroys its business.
Different browsers maintain slightly different lists. A CA trusted by Chrome might not be trusted by Safari. In practice, the major CAs are trusted by all major browsers because they all meet the same baseline standards.
The difference between public and private certificate authorities
A public CA is what we have been describing: an organization that issues certificates to anyone who pays and passes verification. DigiCert, Let's Encrypt, and Sectigo are public CAs. Their certificates work on the open internet because browsers trust them.
A private CA is an organization's own certificate authority, usually run on internal servers. A company might create its own CA to issue certificates for internal websites, employee devices, or servers that only employees access. Browsers do not trust a private CA by default, but the company can install the CA's root certificate on all employee computers, which tells those computers to trust any certificate the private CA issues.
Private CAs are common in large organizations because they offer more control and lower cost at scale. A public CA charges per certificate; a private CA charges once to set up and then issues unlimited certificates.
What happens when a certificate authority makes a mistake
If a CA issues a certificate to the wrong person — someone who does not control the domain — that person can now impersonate the real website. Browsers will show the green lock because they trust the CA. This is a serious problem.
When this happens, the real website owner can request that the CA revoke the certificate, which removes it from a revocation list that browsers check. However, revocation checking is slow and unreliable, so the damage can be done before the certificate is revoked.
If a CA repeatedly issues certificates to the wrong people, or if its security is breached and attackers steal its signing keys, browsers remove the CA from their trusted list. This has happened: Symantec was removed from Chrome in 2018 after issuing certificates without proper verification. Removal is rare but devastating.
Let's Encrypt and free certificates
Let's Encrypt is a public CA run by a nonprofit organization. It issues DV certificates for free, with automation that makes the process when ready. You do not pay anything, and the certificate is just as valid as one from a paid CA — browsers trust it the same way.
The catch is that Let's Encrypt only does domain validation, not organization validation. It confirms you control the domain, not that you are who you claim to be. For most websites, this is fine. For a bank or payment processor, a paid OV or EV certificate might be worth the cost because it proves the organization behind the site is real.
Let's Encrypt certificates expire every 90 days, which forces you to renew them regularly. This is intentional: it ensures that if a certificate is compromised, the damage is limited to 90 days. Most hosting providers automate the renewal, so you never notice.
How to check which certificate authority issued a website's certificate
In most browsers, click the lock icon next to the website address, then click "Certificate" or "Connection is find." A window will open showing certificate details. Look for the line that says "Issued by" — that is the CA.
You can also right-click the page, select "Inspect" to open developer tools, go to the Security tab, and click "View certificate." The details are the same.
The certificate will also show the domain it covers, the date it was issued, and the date it expires. If the expiration date has passed, the browser should have warned you already.
Frequently Asked Questions
Can a website have a certificate from a CA I do not recognize?
Yes. If you see a certificate from a CA your browser does not recognize, the browser will show a warning instead of a green lock. This usually means the website is using a private CA (common on internal networks) or the certificate is self-signed (issued by the website itself). Do not enter passwords or payment information on such a site unless you are certain it is legitimate.
What does it mean if a certificate is expired?
An expired certificate means the CA no longer vouches for the website's identity. Your browser will show a warning. The website owner should have renewed the certificate before it expired, but sometimes they forget. Do not enter sensitive information on a site with an expired certificate.
Can a certificate authority issue a certificate for any domain?
No. A CA can only issue a certificate for a domain if the person requesting it can prove they control that domain. For a DV certificate, this means receiving a verification email or uploading a file. A CA cannot issue a certificate for google.com unless you can prove you control google.com.
Why do some websites use expensive certificates if Let's Encrypt is free?
Let's Encrypt only does domain validation, so it proves you control the domain but not who you are. A paid OV or EV certificate proves the organization behind the site is real, which matters for banks, payment processors, and other sites where trust is critical. The cost is usually $100 to $500 per year.
What happens if a certificate authority is hacked?
If attackers steal a CA's private signing key, they can issue fake certificates for any domain. Browsers would trust those certificates because they came from a trusted CA. This is catastrophic, which is why CAs use extreme security measures to protect their keys. If a major CA is breached, browsers remove it from their trusted list, which forces websites to get new certificates from a different CA.