Certificate authority (CA)

A certificate authority (CA) is a trusted entity that issues and manages digital certificates in order to guarantee the authenticity and integrity of electronic communication.

It is one of the central pieces of a public key infrastructure, the framework that uses key pairs, one public and one private, to encrypt and digitally sign information.

What the CA issues is a certificate that binds the identity of an entity, a person, a server or a device, to its public key. That binding is what lets two parties who have never met trust each other online, and it is the reason a browser can tell you that the site you are looking at really is the one it claims to be.

What a certificate authority does

Issues certificates. The certificate contains information about the entity, its public key and other relevant detail, and it is what gets presented to authenticate that entity in an online exchange.

Signs them. The CA uses its own private key to sign each certificate it issues. Anybody can verify that signature with the CA’s public key, which is what proves the certificate has not been altered and really came from that authority.

Revokes them. If a private key is lost or an entity’s circumstances change, the CA can revoke a certificate before its expiry date. Revocation is what stops a compromised certificate from carrying on working, and it is published so that relying parties can check it.

Sits in a hierarchy. Authorities are usually organised as a tree, where a root CA issues certificates to subordinate CAs, which in turn issue to end entities. The hierarchy is what makes the model scalable, and it is also what keeps the root key offline and rarely used.

A worked example

A company wants to secure communication inside its own network and decides to run its own certificate authority.

The root. It creates a root CA, which signs its own certificate and then signs the certificates of the subordinate authorities beneath it.

The subordinates. Each subordinate covers a division or a purpose, and issues certificates to the users, servers and devices in its scope.

The signature. Every certificate issued carries a signature generated with the issuing authority’s private key, so any relying system can verify it with the corresponding public key.

Revocation. If a certificate is compromised or is no longer valid, the issuing authority revokes it and publishes that in a certificate revocation list, so it stops being accepted.

The result is an internal chain of trust: users and systems inside the organisation can rely on each other’s identity, and the traffic between them is both authenticated and encrypted.

The CA inside the PKI, and how it differs from an RA and a VA

The public key infrastructure is the whole system. The certificate authority is one of its pieces, and there are two others that get confused with it because the names are almost identical.

The certificate authority issues and signs the certificate. It is the party that puts its name behind the claim that this public key belongs to whoever it says.

The registration authority checks beforehand that the applicant really is who they claim to be. It issues nothing: it prepares the decision.

The validation authority answers the question that comes afterwards, which is whether a certificate is still valid today. It is the piece that holds up revocation.

In one sentence: the RA looks before, the CA signs, and the VA answers after.

And there is a consequence to concentrating that much trust in one place. If a CA can be made to issue a certificate it should not have issued, everybody who trusts it is deceived at once. On an internal engagement the organisation’s own certificate services are a standard objective, because a misconfigured template lets an unprivileged user request a certificate that authenticates them as an account that is not theirs, which is the family of issues catalogued as AD CS abuse.

Where to read more

RFC 5280, Internet X.509 Public Key Infrastructure Certificate and CRL Profile: the IETF standard that defines the certificate profile in use, with the technical detail on structure and revocation.

Microsoft, Public Key Infrastructure and certificates: how a PKI is deployed in a Windows environment, including how certification authorities are configured.