CA

A CA (Certificate Authority) is a trusted third party that issues digital certificates binding public keys to identities, serving as the trust root of PKI.

Purpose

To provide trusted third-party assurance binding public keys to identities so that unfamiliar parties can establish trust.

Mechanism

The CA verifies the applicant identity (DV/OV/EV levels) and signs the certificate with its private key. Root CAs are self-signed and preinstalled in OS/browser trust stores; intermediate CAs are signed by the root. A compromised CA can issue forged certificates (e.g., the DigiNotar incident), hence strict audits are required.

Use cases

TLS certificate issuance
Code-signing certificates
S/MIME email certificates
Enterprise internal PKI

Examples

Input

CSR + identity verification

Output

CA-signed certificate

DV/OV/EV

Common errors

Trusting all issuances from a compromised CA: Monitor CT logs and remove the problematic CA promptly

Related terms

X.509 Certificate

An X.509 certificate binds a public key to an identity, signed by a CA for verification, containing validity, issuer, subject, and extension fields.

PKI (Public Key Infrastructure) is the system managing digital certificates and public keys, comprising CAs, registration authorities, certificate repositories, and revocation mechanisms, underpinning TLS and signatures.

TLS (Transport Layer Security) provides encryption, integrity, and authentication at the transport layer; it replaced SSL and underpins HTTPS, SMTPS, and more.

Zero trust is the "never trust, always verify" security model: no trust merely for being inside the network; every access verifies identity and authorization.

References