A certificate authority is the organization that verifies a website's identity and issues the digital certificate that proves it

When you visit a website and see a padlock icon in your browser's address bar, a certificate authority (CA) is the reason that padlock is there. The CA checked that the website owner actually owns the domain name, then issued a digital certificate — a file that says "I have verified this is a legitimate business." Your browser trusts the CA, so it trusts the certificate, so it trusts the website enough to let you send passwords and payment information there.

Without a CA, any person could claim to be your bank's website. With a CA, that claim has to be backed up by paperwork and verification. The CA is essentially a notary public for the internet — they do not run the website, they do not host it, and they do not see your traffic. They just confirm the website is what it says it is.

Key Takeaways

  • A certificate authority verifies that a website owner controls the domain name and issues a digital certificate proving the website's identity.
  • Your browser comes pre-loaded with a list of CAs it trusts, so when a website presents a certificate from one of those CAs, your browser knows it is safe to send sensitive information.
  • If a website's certificate is issued by a CA your browser does not recognize, or if the domain name on the certificate does not match the website you are visiting, your browser will show a warning.
  • Website owners must renew their certificates periodically — usually every one to three years — or the padlock will disappear and visitors will see a security warning.

How a certificate authority verifies a website owner

The process starts when a website owner generates a certificate signing request (CSR) — a file that contains information about their business and domain name. They send this to a CA and pay a fee, which ranges from free (for basic certificates) to several hundred dollars per year (for certificates that cover multiple domains or come with extra insurance).

The CA then checks that the person requesting the certificate actually controls the domain name. For a basic check, the CA sends an email to an address listed in the domain's registration records and asks the owner to click a link. For higher-security certificates, the CA may verify business registration documents, call a phone number on file, or check public records. Once the CA is satisfied, it signs the certificate with its own private key — a cryptographic signature that proves the CA issued it and has not been tampered with.

The website owner then installs this certificate on their web server. Every time someone visits the website, the server sends the certificate to the visitor's browser. The browser checks whether the certificate was signed by a CA it recognizes, whether the domain name on the certificate matches the website address, and whether the certificate has expired. If all three checks pass, the browser shows the padlock.

Why your browser trusts certain certificate authorities

Your browser comes pre-loaded with a list of CAs it considers trustworthy. These include companies like DigiCert, Let's Encrypt, Sectigo, and GlobalSign. This list is built into the browser software itself — when you update your browser, you are partly updating this list of trusted CAs.

A CA only gets on this list after meeting strict security standards. Browser makers like Google, Mozilla, and Apple audit CAs regularly to make sure they are not issuing certificates to the wrong people. If a CA is caught issuing a certificate for a domain it did not verify, or if its security is breached, browser makers can remove it from the trusted list. When that happens, websites using that CA's certificates will suddenly show security warnings to visitors.

This system works because the trust is distributed. You do not have to trust every website individually — you only have to trust a small number of CAs, and those CAs do the verification work for thousands of websites.

The difference between certificate types

Not all certificates require the same level of verification. A domain validation (DV) certificate only confirms that someone controls the domain name — the CA sends an email and waits for a response. These are fast and cheap, and they are fine for blogs and small websites. Let's Encrypt, which offers free certificates, issues only DV certificates.

An organization validation (OV) certificate requires the CA to verify that a real business owns the domain. The CA checks business registration documents and may call a phone number. These certificates show more information in the browser — when you click the padlock, you see the company name, not just the domain. Banks and payment processors often use OV certificates.

An extended validation (EV) certificate requires the most thorough verification. The CA checks legal documents, ownership records, and sometimes conducts a phone interview. Historically, browsers showed a green bar with the company name for EV certificates, but most browsers have phased out this visual distinction. The certificate itself is more expensive and takes longer to issue, but it does not provide much more security than an OV certificate for most visitors.

What happens when a certificate expires or is invalid

Certificates have an expiration date — usually one, two, or three years from the issue date. The website owner is responsible for renewing the certificate before it expires. If they do not, the certificate becomes invalid, and visitors' browsers will show a warning: "Your connection is not private" or "This site's security certificate is not trusted."

A certificate can also become invalid if the domain name on the certificate does not match the website address. For example, if a certificate is issued for example.com but the website is at www.example.com, some browsers will show a warning. Modern certificates can cover multiple domain variations, but the owner has to request this when they order the certificate.

If a website's certificate is invalid, your browser is not saying the website is malicious — it is saying the website owner did not complete the verification process or did not renew their certificate on time. It is still possible to visit the site (most browsers let you click through the warning), but it is a sign that something is not right.

Who pays for certificate authorities

Website owners pay for certificates, not visitors. The cost depends on the type of certificate and the CA. Let's Encrypt offers free DV certificates and is supported by donations from companies like Google, Mozilla, and Cisco. Commercial CAs charge anywhere from zero to several hundred dollars per year, depending on the level of verification and the number of domains covered.

Some web hosting companies include a free certificate with their hosting plan — usually a Let's Encrypt certificate or a basic DV certificate from another CA. If you are building a website, check whether your hosting provider offers a free certificate before paying for one separately.

The role of root certificates and certificate chains

When a CA issues a certificate, it signs it with a private key. But how does your browser know that the CA's signature is legitimate? The answer is a root certificate — a certificate that the CA itself is signed with, and that your browser has stored locally.

This creates a chain of trust. Your browser trusts the root certificate (because it came pre-loaded in the browser software). The root certificate vouches for the CA's certificate. The CA's certificate vouches for the website's certificate. Each link in the chain is cryptographically signed, so if anyone tampers with any certificate in the chain, the whole thing breaks and your browser shows a warning.

When you visit a website, the server sends not just the website's certificate but also the CA's certificate (and sometimes intermediate certificates in between). Your browser checks the entire chain to make sure each certificate was signed by the one above it, all the way up to a root certificate it recognizes.

Frequently Asked Questions

What does it mean if my browser shows "certificate not trusted"?

It usually means the website's certificate was issued by a CA your browser does not recognize, or the certificate has expired, or the domain name on the certificate does not match the website address. It does not necessarily mean the website is dangerous — it means the website owner did not complete the verification process or did not renew their certificate. Contact the website owner and ask them to fix it before sending any sensitive information.

Can a certificate authority see my passwords or credit card information?

No. The CA issues the certificate and verifies the website owner's identity, but it does not see the traffic between your browser and the website. The certificate encrypts your connection, but the CA is not involved in that encryption. Only the website owner can see what you send.

Why do some websites have free certificates and others pay for them?

Let's Encrypt offers free certificates because it is a nonprofit supported by donations. Commercial CAs charge because they employ people to verify business documents and handle customer support. A free certificate and a paid certificate provide the same encryption — the difference is usually in the level of verification and the insurance that comes with it.

If I see a padlock, is the website definitely safe?

A padlock means the website's identity has been verified by a trusted CA and the connection is encrypted. It does not mean the website is honest, that it will not steal your information, or that it is not running a scam. A scammer can get a valid certificate for their fake website. The padlock is one safety check, not the only one.

How often do I need to renew a certificate?

That depends on the certificate. Most certificates last one to three years. The website owner is responsible for renewing before the expiration date. If you own a website, set a calendar reminder a month before your certificate expires, or use a hosting provider that renews automatically.