What is a Certificate Authority?
A Certificate Authority (CA) is a trusted organization that issues digital certificates. These certificates verify the identity of entities (websites, organizations, individuals) and enable secure encrypted communications through PKI.
CA Hierarchy
Root CA
- Top of trust chain
- Self-signed certificate
- Highly protected
Intermediate CA
- Signed by Root CA
- Issues end-entity certificates
- Limits root exposure
End-Entity
- Websites, servers
- Users, devices
- Issued by Intermediate
Certificate Types
Domain Validation (DV)
- Verifies domain control
- Automated issuance
- Basic trust
Organization Validation (OV)
- Verifies organization
- Manual validation
- Business identity
Extended Validation (EV)
- Rigorous verification
- Legal entity validation
- Highest trust
Certificate Lifecycle
-
Generation
- Key pair creation
- CSR submission
-
Validation
- Identity verification
- Domain control
-
Issuance
- Certificate creation
- Distribution
-
Renewal
- Before expiration
- Revalidation
-
Revocation
- If compromised
- CRL/OCSP updates
Public CAs
- Let's Encrypt
- DigiCert
- Sectigo
- GlobalSign