Certificate Authority
A certificate authority is an organization that issues digital certificates, thereby confirming that a website or service actually belongs to the stated operator. Without it, encrypted communication on the internet would not be trustworthy.
When you visit a website and see a padlock icon in the address bar, there’s a chain of trust behind it. Your browser wants to make sure it’s really talking to the bank or the shop — and not to someone pretending to be them. To do this, it needs someone it trusts blindly and who vouches for others. This role is taken on by the certificate authority. It is an organization that issues digital IDs — so-called certificates — thereby confirming: “Yes, this website really belongs to this company.” There are several hundred certificate authorities worldwide, but only a few dozen are considered so-called root certificate authorities, which browsers and operating systems trust directly.
Foundation of encrypted communication
Without certificate authorities, encryption on the internet would have a fundamental problem. Imagine you receive a letter with the stamp “Your Bank.” How do you know the stamp is genuine? In real life, there are authorities and printed IDs that ensure this. On the internet, certificate authorities take on exactly this task.
Their value lies in being an independent, trustworthy third party. Neither the operator of a website nor the user alone can confirm themselves — that would be like issuing your own passport. Only through the neutral entity does a real anchor of trust emerge. If a certificate authority falls into disrepute, it can affect millions of websites at once: in 2011, the Dutch CA DigiNotar was hacked, after which all major browsers revoked their trust in it — a total failure for the entire infrastructure that had been built on it.
How a certificate authority issues a certificate
The process starts with the website operator. They generate a key pair — a public and a private key — and send a request with the public key and their details to the certificate authority. The authority then checks whether the applicant really has control over the specified domain. For simple certificates, an automatic test is sufficient, for example placing a specific file on the website. For certificates that are also meant to state the company name on the ID, commercial register extracts are additionally checked.
If everything checks out, the certificate authority signs the certificate with its own private key — this is called a digital signature. Your browser knows the public keys of all trustworthy root certificate authorities and can verify this signature. If it matches, the connection is considered secure. Most certificates expire after 90 days or one year and must then be renewed so that outdated keys don’t remain a security risk.
In practice, there is often an intermediate step: a root certificate authority doesn’t directly sign every website certificate, but first signs that of a so-called intermediate CA. This then issues the actual certificates. This way, the especially valuable root key stays offline and well protected.
Certificate authorities in everyday life and in the news
Every time you visit a website with “https” in the address, there’s a certificate from a CA behind the scenes. The best-known providers are Let’s Encrypt — a nonprofit initiative that issues certificates for free — as well as commercial providers like DigiCert or Sectigo. Let’s Encrypt has massively accelerated the spread of HTTPS: since its launch in 2015, over three billion certificates have been issued.
In tech news, certificate authorities usually come up when something goes wrong. Google has repeatedly threatened to revoke trust in individual CAs because they didn’t issue certificates carefully enough. In 2024, Entrust, one of the oldest CAs, came close to being removed from Chrome and Firefox. Such decisions are effectively made by the browser makers and operating system developers, who determine which root certificate authorities are included in their pre-installed trust list.
CAs also play a role in corporate networks. Companies often operate their own internal certificate authorities to secure connections within the company network. Anyone who has ever set up a work laptop and installed a “corporate certificate” in the process has experienced exactly this: the device learns to trust the internal CA.