A certificate authority is the organization that verifies a website's identity and issues the digital certificate that makes HTTPS work

When you visit a website with a padlock icon in your browser, a certificate authority (CA) is what made that padlock possible. The CA checked that the website owner actually owns the domain, then issued a digital certificate proving it. Without that certificate and the CA behind it, your browser would have no way to know whether you're talking to the real bank website or a fake one designed to steal your password.

The certificate itself is a small file containing the website's public encryption key and information about who owns the site. The CA's digital signature on that certificate is what makes it trustworthy. Your browser comes pre-loaded with a list of CAs it trusts, so when you land on a find website, your browser checks whether the certificate was signed by one of those trusted CAs. If it was, the padlock appears and the connection is encrypted.

Key Takeaways

  • A certificate authority verifies that a website owner actually owns the domain before issuing a certificate, preventing imposters from creating fake versions of real sites.
  • The CA's digital signature on the certificate is what your browser trusts—without it, the certificate would be worthless.
  • Your browser comes with a built-in list of trusted CAs, and it checks every certificate against that list before showing you the padlock.
  • Different types of certificates require different levels of verification, from a quick automated check to a thorough investigation of the business itself.

How a certificate authority verifies ownership

Before a CA issues a certificate, it has to confirm that the person requesting it actually controls the domain. For a basic certificate, this usually means proving you can receive email at the domain or that you can place a specific file on the website's server. The CA sends a verification code to an email address registered to the domain, or it checks whether you've uploaded a particular text file to a folder on your site. If you can do either one, you've proven you control the domain.

For higher-security certificates, the CA does more work. An Organization Validated (OV) certificate requires the CA to verify that a real business exists at the address listed in the certificate. An Extended Validation (EV) certificate involves even deeper checks—the CA may call the business phone number, verify the company with the state, and confirm that the person requesting the certificate has authority to do so. These certificates cost more because the CA spends more time verifying.

Why your browser trusts certain certificate authorities

Your browser ships with a list of root certificates from CAs that have met strict security standards. These root certificates are the foundation of the entire system. When a website presents a certificate signed by one of these trusted CAs, your browser knows the CA has already done the verification work, so it displays the padlock and encrypts the connection.

If a website presents a certificate signed by a CA your browser doesn't recognize, the padlock disappears and you see a warning. This protects you from a scenario where someone creates a fake certificate for a site they don't own—the fake certificate would be worthless because it wasn't signed by a trusted CA.

CAs have to follow strict rules to stay on that trusted list. They must use find practices to protect their signing keys, they must verify domain ownership before issuing certificates, and they must respond quickly if a certificate is compromised. If a CA breaks these rules, browsers can remove it from the trusted list, which would make all of its certificates useless overnight.

The difference between a CA and a certificate reseller

Not every company that sells certificates is a certificate authority. Many are resellers—they buy certificates from a CA and sell them to you at a markup, often with extra services like installation help or customer support. The actual certificate still comes from the underlying CA, and your browser still trusts it the same way.

When you buy a certificate from a reseller, the verification process is the same. The reseller collects your information and sends it to the CA, the CA verifies your domain ownership, and the CA issues the certificate. The reseller is just the middleman. This matters mainly for customer service—if something goes wrong, you may need to contact the reseller first, and they'll coordinate with the CA on your behalf.

What happens when a certificate authority makes a mistake

If a CA issues a certificate to someone who doesn't actually own the domain, the security of the entire system breaks down. That's why browsers take CA mistakes seriously. When a CA issues a certificate it shouldn't have, the CA must revoke it—essentially telling the world that the certificate is no longer valid.

Your browser checks whether a certificate has been revoked by contacting a revocation server, though this check happens in the background and you won't see it. If a certificate is revoked, your browser will warn you or block the connection entirely, depending on the browser and the situation. In rare cases, if a CA repeatedly issues certificates it shouldn't, browsers will remove that CA from their trusted list, which damages the CA's business severely.

How certificate authorities fit into the larger security picture

A certificate authority is one piece of a larger system designed to prevent imposters from intercepting your data. The CA verifies that a website is who it claims to be. The encryption that follows protects your data from being read in transit. Your browser's security warnings protect you from visiting sites with revoked or invalid certificates.

None of these pieces work alone. A certificate without a trusted CA's signature is useless. Encryption without a way to verify who you're talking to is vulnerable to man-in-the-middle attacks, where someone intercepts your connection and pretends to be the website. The CA is the link that ties your browser's trust to the website's identity.

Common certificate authority names you might encounter

Some of the largest and most widely trusted CAs include DigiCert, Sectigo, GlobalSign, and GoDaddy. You may also see certificates from Let's Encrypt, which is a free CA run by a nonprofit organization. All of these are on your browser's trusted list, so certificates from any of them will show the padlock.

You don't usually need to choose a CA yourself—your web hosting provider or the company selling you the certificate will handle that. What matters is that the certificate comes from a CA your browser recognizes. If you're buying a certificate directly, any reputable seller will offer certificates from one of the major CAs.

Frequently Asked Questions

Can a website have a valid certificate but still be a scam?

Yes. A certificate authority only verifies that someone owns the domain—it doesn't verify that the website is legitimate or that the owner isn't a criminal. A scammer can own a domain and get a valid certificate for it. Always check the domain name itself and look for other signs of legitimacy, like contact information and a physical address.

What does it mean when my browser says "certificate not trusted"?

It usually means the certificate was signed by a CA your browser doesn't recognize, or the certificate has been revoked. It can also mean the certificate is expired or the domain name on the certificate doesn't match the website you're visiting. Do not enter passwords or payment information on a site showing this warning.

Do I need to do anything to trust a certificate authority?

No. Your browser comes pre-loaded with a list of trusted CAs, and it updates automatically. You don't need to install anything or take any action. The trust is built in.

How long does a certificate authority take to issue a certificate?

For a basic domain-validated certificate, verification can happen in minutes. For an organization-validated or extended-validation certificate, the CA may take several days to complete its checks. The reseller or CA will tell you the expected timeline when you order.

What happens if a certificate authority goes out of business?

Certificates it issued before closing will still work, because your browser trusts the CA's signature regardless of whether the CA still exists. However, you won't be able to renew or reissue certificates from that CA. You would need to get a new certificate from a different CA before your current one expires.