🏷️Certificate Authority

NEW

Also known as: CA

A trusted entity that issues, manages, and revokes digital certificates, anchoring trust in the PKI hierarchy.

DESCRIPTION

A Certificate Authority (CA) validates identities and issues X.509 certificates that bind those identities to public keys. Public CAs are trusted by default in major operating systems and browsers, enabling secure web communications. Private CAs operate within enterprises to support internal services and device authentication. CAs publish revocation information through CRLs and OCSP to maintain trustworthiness. Policies, audits, and CA/Browser Forum requirements govern issuance and operations. Mis-issuance or compromise of a CA can severely impact ecosystem trust, necessitating rigorous controls and transparency.

ALTERNATIVE DEFINITIONS

Wikipedia

A certificate authority (CA) is an entity that issues digital certificates.

Concise definition emphasizing the issuance role.

Source

NIST CSRC

A trusted entity that issues and revokes public-key certificates.

Includes revocation responsibility in addition to issuance.

Source

RELATED TERMS

Public Key Infrastructure Certificate Registration Authority Root Certificate Intermediate Certificate Certificate Policy Certificate Revocation List Online Certificate Status Protocol Trust Store TLS

COMPETING TERMS

PGP Web of Trust

KNOWLEDGE AREAS

Data Security Infrastructure Software Engineering

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Cloud Architect IT Auditor Application Administrator Software Developer

EXTERNAL SOURCES

• Wikipedia - Certificate authority
• CA/Browser Forum - Baseline Requirements for public CAs
• Mozilla - Mozilla CA program policies and processes

TOP QUESTIONS

What is the difference between a root and an intermediate Certificate Authority?

A root CA is self-signed and anchors trust stores. Intermediate CAs are signed by the root, limiting risk and enabling operational separation and policy segmentation.

Category: Explanation

How do Certificate Authorities verify identities?

They follow defined validation procedures (DV, OV, EV) and rely on registration authorities or automation to confirm domain control and organization identity.

Category: Process

What happens when a Certificate Authority is compromised?

Browsers and OS vendors can distrust the CA or affected intermediates. Rapid revocation, incident reporting, and remediation actions are triggered to protect users.

Category: Risk

How do public and private Certificate Authorities differ?

Public CAs are widely trusted by default; private CAs serve internal enterprise needs and require custom trust distribution to clients.

Category: Comparison

What controls govern Certificate Authorities?

Controls include CA/Browser Forum Baseline Requirements, audits (e.g., WebTrust), key ceremonies, HSM use, and rigorous incident response procedures.

Category: Governance

How do Certificate Authorities manage revocation?

They publish CRLs and support OCSP. Short-lived certificates reduce reliance on revocation checks in some scenarios.

Category: Operations

Why do some products recommend short-lived certificates?

Short lifetimes limit exposure from key compromise and reduce revocation dependencies, improving security and reliability.

Category: Practice

What is certificate transparency and its role for CAs?

Certificate Transparency logs issued certificates publicly, enabling detection of mis-issuance and improving ecosystem oversight.

Category: Monitoring

How do automated issuance protocols impact Certificate Authorities?

Protocols like ACME enable rapid, secure issuance, improving agility while maintaining policy controls and auditability.

Category: Automation