Certificate authority (CA)
A certificate authority (CA) is an organization trusted, under the X.509 framework defined in RFC 5280, to verify a domain's or organization's identity and sign a TLS certificate vouching for it. Browsers and operating systems ship with a built-in list of root CAs they trust directly; a CA issues certificates either directly off a root or, far more commonly, off an intermediate certificate chained back to that root, which lets the root's private key stay offline and protected while day-to-day issuance happens lower down the chain. A CA's trust is conditional, not permanent: root programs can and do remove a CA that mis-issues certificates or fails an audit, which immediately breaks every certificate it ever signed. Most publicly trusted CAs today validate only domain control before issuing, a narrower check than validating organizational identity, though both produce a cryptographically identical certificate once issued.
By AdminKit team, Netbase JSC · Updated