Certificate Authorities

A Certificate Authority (CA) is a trusted organization that issues and digitally signs certificates.

When a CA signs a certificate, it is asserting: we have verified this identity, and you can trust this public key.

Browsers and operating systems ship with a built-in list of trusted root CAs.

Because everyone already trusts these roots, a certificate signed by them is automatically trusted without manual configuration.

CAs operate in a hierarchy:

• The Root CA is kept offline and rarely used; it is the ultimate trust anchor.
• Intermediate CAs are signed by the root and do the day-to-day signing.

This protects the precious root key from exposure.

CAs verify identity at different rigor levels:

• Domain Validation (DV) only proves control of a domain.
• Organization Validation (OV) verifies the organization exists.
• Extended Validation (EV) performs deep legal vetting.

For Domain Validation, the CA asks you to prove you control the domain, often by serving a token at a URL or adding a DNS record.

A public CA (like a commercial provider) is trusted by browsers globally.

A private CA is run internally by an organization for its own devices and services. Its root must be manually installed on every client that should trust it.

Let's Encrypt is a free, automated public CA. It uses the ACME protocol so clients can request and renew certificates without human interaction.

The list of trusted root CAs lives in a trust store.

• Operating systems maintain a system trust store.
• Browsers may use their own.

You can inspect trusted roots on many Linux systems.

If a CA's signing key is stolen or it issues fraudulent certificates, the entire trust model breaks.

Past incidents have led browsers to distrust entire CAs, instantly invalidating all their certificates. This is why CA security is paramount.

Certificate Transparency (CT) requires CAs to log every certificate they issue into public, append-only logs.

This lets domain owners detect certificates issued for their domain without permission, catching rogue or mis-issued certificates.

When picking a CA, consider:

• Trust coverage across browsers and devices
• Automation support (ACME)
• Validation level needed (DV/OV/EV)
• Cost and support

Why are intermediate CAs used instead of signing everything with the root CA?

You learned that Certificate Authorities issue and sign certificates that browsers trust.

• Trust flows from offline roots through intermediates.
• Validation comes in DV, OV, and EV levels.
• Certificate Transparency logs catch mis-issuance.

Next, we follow the chain of trust from a leaf certificate up to the root.