What Is a Certificate Authority?
A certificate authority (CA) is a trusted organization that issues the digital certificates vouching for identities online. When your browser trusts that a site is really example.com, it is trusting a CA that validated the site and signed its certificate. CAs are the anchor of public key infrastructure — and the reason the whole system works or fails.
What does a CA actually do?#
A CA performs three jobs:
- Validate — confirm the requester controls the identity being certified (e.g. proving they own the domain via a DNS record or a file on the server).
- Issue — bind that identity to the requester’s public key in a certificate signed with the CA’s private key.
- Revoke — publish that a certificate is no longer valid (via CRLs or OCSP) if a key is compromised.
Because the CA’s root certificate is pre-installed in operating systems and browsers, anything it signs is trusted automatically — which is enormous power resting on the CA doing its job correctly.
How much does a certificate really prove?#
That depends on the validation level:
| Type | Validates | Time to issue |
|---|---|---|
| DV (Domain Validation) | Control of the domain | Minutes |
| OV (Organization Validation) | Domain + organization exists | Days |
| EV (Extended Validation) | Rigorous legal vetting | Days–weeks |
All three provide identical encryption strength. They differ only in identity assurance — a common misconception is that DV is “less secure,” when it simply proves less about who is behind the domain.
CAs make TLS and digital signatures trustworthy at scale. See the wider system at public key infrastructure and the Security Fundamentals hub.
Frequently asked questions#
What does a certificate authority actually do?
A certificate authority validates that a requester controls an identity — a domain, an organization — and then issues a digital certificate binding that identity to a public key, signed with the CA’s own key. Browsers and operating systems trust certificates that chain up to a CA in their pre-installed root store.
What is the difference between DV, OV, and EV certificates?
They differ in how much the CA validates. Domain Validation (DV) only proves control of the domain and is issued in minutes. Organization Validation (OV) checks the organization exists. Extended Validation (EV) does the most rigorous vetting. All three provide the same encryption; they differ only in identity assurance.