A certificate authority (CA) is a trusted organization that issues digital certificates binding a public key to a domain, organization, or individual after validating their identity. CAs are the foundation of how browsers and clients trust websites over SSL/TLS connections.
How it works
When you request an SSL certificate, you generate a key pair and submit a Certificate Signing Request (CSR) to the CA. The CA then performs identity validation—checking that you control the domain (DV), own the organization (OV), or meet stricter requirements (EV). Once verified, the CA signs your certificate with its own private key, cryptographically vouching for the binding between your public key and your identity.
Your certificate chains up through intermediate CAs to a root CA certificate that is pre-installed in browsers and operating systems. This creates a "chain of trust." Clients verify revocation status via CRLs (Certificate Revocation Lists) or OCSP (Online Certificate Status Protocol), defined in RFC 5280 and RFC 6960 respectively.
Since 2018, all publicly-trusted certificates must be logged in Certificate Transparency (CT) logs per RFC 9162, and modern browsers enforce CT compliance.
Common examples
Let's Encrypt (automated, free), DigiCert, Sectigo, and GlobalSign are publicly-trusted CAs whose root certificates ship in major OS and browser trust stores.
WarningA valid CA-signed certificate only proves domain or organization control was verified at issuance—it does not guarantee the site is legitimate. Domain-validated (DV) certificates verify domain control alone, not business identity, so phishing sites can obtain valid DV certificates. Always validate a site's actual legitimacy independently.
You can check certificate details and issuance with our SSL check tool.