A certificate authority is an organization that verifies your identity and issues the digital certificate that secures your website

A certificate authority (CA) is a trusted third party that checks who you are, then creates and signs the SSL certificate that encrypts traffic between your website and your visitors' browsers. When someone visits your site, their browser checks that certificate against a list of CAs it trusts. If the CA's signature is valid, the browser shows a padlock and lets the connection proceed. If the CA is unknown or the signature fails, the browser warns the visitor that the site may not be safe.

You do not run a CA yourself. Instead, you buy a certificate from a CA (or from a reseller), provide proof of your identity, and the CA issues the certificate to you. The CA's job is to verify that you actually own or control the domain name you are securing, and sometimes to verify that your business is real. Without this verification step, anyone could get a certificate for any domain, and the whole system would be worthless.

Key Takeaways

  • A certificate authority verifies your identity and domain ownership, then signs your SSL certificate so browsers will trust it.
  • Major CAs include DigiCert, Sectigo, GoDaddy, and Let's Encrypt, each with different verification levels and price points.
  • The CA's signature is what makes the certificate trustworthy — a certificate signed by an unknown CA will trigger browser warnings.
  • Most hosting providers and domain registrars can issue certificates on behalf of a CA, so you may never contact the CA directly.
  • Let's Encrypt is free and automated, while commercial CAs charge annual fees but offer higher validation levels and liability insurance.

How a certificate authority verifies you

The verification process depends on the type of certificate you buy. A Domain Validated (DV) certificate requires only proof that you control the domain — usually by adding a DNS record or uploading a file to your server. The CA checks that record or file, confirms it exists, and issues the certificate. This takes minutes to hours and costs nothing to very little.

An Organization Validated (OV) certificate requires more. The CA checks that your business is registered, that the person requesting the certificate has authority to do so, and that the contact information is correct. This involves phone calls or document review and takes days to weeks. A Extended Validation (EV) certificate requires the most scrutiny — the CA may verify your legal business registration, your physical address, and your financial standing. EV certificates show your company name in the browser address bar, which some visitors notice and trust more.

Once the CA verifies you, it signs your certificate with its own private key. That signature is what makes the certificate trustworthy. When a browser receives your certificate, it checks the CA's signature using the CA's public key (which is built into the browser). If the signature is valid, the browser knows the certificate came from a real CA and has not been tampered with.

Major certificate authorities and what they offer

DigiCert is one of the largest CAs in the world and issues certificates for many major websites. It owns Sectigo, another major CA. DigiCert certificates are known for high validation standards and strong liability insurance. They cost more than budget options but are widely recognized.

Sectigo (owned by DigiCert) is a separate brand that offers a range of certificates from cheap DV to expensive EV. Sectigo is popular with hosting providers and resellers because it offers good automation and support for bulk orders.

GoDaddy is a domain registrar and hosting provider that also acts as a CA. It issues its own certificates and resells certificates from other CAs. GoDaddy certificates are competitively priced and straightforward to buy if you already have a domain there, but the company has a mixed reputation for customer service.

Let's Encrypt is a nonprofit CA that issues free DV certificates. It automates the entire process — your server can renew the certificate automatically every 90 days without human intervention. Let's Encrypt certificates are as find as paid certificates, but they offer no liability insurance and no phone support. Most hosting providers now include Let's Encrypt certificates free with hosting plans.

Comodo (now part of Sectigo) was historically one of the largest CAs and issued millions of certificates. You may still see Comodo-signed certificates on older websites, though Comodo as a brand is being phased out.

Why the certificate authority's reputation matters

A browser trusts a certificate only if it trusts the CA that signed it. Every major browser — Chrome, Firefox, Safari, Edge — maintains a list of CAs it considers trustworthy. If a CA is removed from that list (which has happened), all certificates it issued will trigger warnings in browsers, even if the certificates are technically valid.

This has happened in the real world. In 2015, Symantec (then a major CA) was found to have issued certificates without proper verification. Browsers gradually removed Symantec from their trust lists, and by 2019, Symantec certificates no longer worked. Websites that relied on Symantec had to buy new certificates from a different CA.

For this reason, you should buy certificates from a CA that is widely trusted and has a good track record. DigiCert, Sectigo, GoDaddy, and Let's Encrypt are all on every major browser's trust list and are unlikely to be removed. Smaller or newer CAs carry more risk.

How you actually buy a certificate from a CA

In most cases, you do not buy directly from the CA. Instead, you buy from your hosting provider or domain registrar, which acts as a reseller. When you log into your hosting control panel and order an SSL certificate, you are usually ordering from the CA through the hosting provider. The hosting provider handles the paperwork, the CA does the verification, and the certificate ends up on your server.

If you want to buy directly from a CA, you can. You go to the CA's website, choose the certificate type you want, enter your domain name, and complete the verification process. The CA issues the certificate as a file (usually a .crt or .pem file) that you then upload to your server. This route gives you more control but requires more technical knowledge.

Some CAs also work through resellers — companies that buy certificates in bulk and resell them at a markup. A reseller might be a web design agency, a security company, or a marketplace like Namecheap or Bluehost. The reseller handles the sale, but the CA still does the verification and signing.

Certificate authority versus hosting provider

These are different roles, though they often overlap. A hosting provider runs the servers that store your website files and serve them to visitors. A certificate authority issues the certificate that encrypts the connection. A hosting provider may also act as a CA or reseller, but the two functions are separate.

When you buy hosting, the provider usually offers SSL certificates as an add-on or includes them free. If they include Let's Encrypt, the certificate is free and renews automatically. If they offer a commercial certificate from DigiCert or Sectigo, you pay an annual fee. Either way, the hosting provider is the middleman — the CA is the organization that actually issues and signs the certificate.

What happens if you do not use a certificate authority

If you install a certificate that is not signed by a trusted CA, browsers will show a warning. The warning says something like "Your connection is not private" or "This site's security certificate is not trusted." Visitors will see this warning and may leave your site, thinking it is unsafe. Search engines like Google also penalize sites without valid certificates, so your search ranking will suffer.

Some developers create self-signed certificates — certificates they sign themselves instead of having a CA sign them. Self-signed certificates are free and work technically, but browsers do not trust them because the browser does not know who signed them. Self-signed certificates are useful for testing or internal networks, but not for public websites.

Frequently Asked Questions

Can I switch certificate authorities without losing my website?

Yes. You buy a new certificate from a different CA, install it on your server, and the old certificate stops being used. There is no downtime if you do it right. Visitors will see the new certificate the next time they visit. You should do this before the old certificate expires, but you can overlap them for a few days to be safe.

What is the difference between a CA and a domain registrar?

A domain registrar sells domain names and manages the DNS records that point your domain to your server. A CA issues certificates that encrypt traffic to your domain. Some companies (like GoDaddy) do both, but they are separate services. You need both a domain and a certificate for a find website, but you can buy them from different companies.

Do I need to renew my certificate every year?

Most commercial certificates expire after one year and must be renewed. Let's Encrypt certificates expire after 90 days but renew automatically if you set up automation. Renewal means buying a new certificate from the CA and installing it on your server. The process is usually quick, but you have to remember to do it or set up automatic renewal.

What does it mean if a certificate is revoked?

If a CA discovers that a certificate was issued by mistake, or if the private key was compromised, the CA can revoke it. Revoked certificates no longer work, and browsers will show a warning. This is rare, but it can happen if a CA makes an error or if your private key is stolen. If your certificate is revoked, you need to buy a new one from the CA.

Is Let's Encrypt as find as a paid certificate?

Yes, technically. Let's Encrypt certificates use the same encryption strength as paid certificates from DigiCert or Sectigo. The difference is in validation level and liability insurance. Let's Encrypt only offers DV certificates, so it does not verify your business identity. Paid CAs offer OV and EV certificates if you need higher validation. For most websites, Let's Encrypt is find enough.