Registration authority (RA)

A registration authority, or RA, is the part of a public key infrastructure that verifies who an applicant is, before any certificate is issued to them.

It issues nothing itself. What it produces is a decision: that this person, this company or this system is who they claim to be, and that the evidence supporting that claim was collected and recorded.

Everything downstream rests on that decision. A certificate is only worth what the identity check behind it was worth, which is why the RA is a role in its own right rather than a step inside somebody else’s.

What it does

Identifies the applicant. Using whatever the certificate policy requires: documents, a company registry, an in-person appearance, control of a domain, or possession of a device.

Collects and keeps the evidence. The record of how the identity was established has to survive, because it is what an auditor or a court will ask for later.

Passes a verified request to the certification authority. The CA signs; the RA is why the CA is willing to.

Applies the policy consistently. Different certificate types demand different levels of assurance, and deciding which check belongs to which level is the RA’s job rather than a formality.

A worked example

A bank issues digital certificates so customers can sign transactions.

A customer applies. The bank’s registration authority checks their identity through the process the certificate policy sets out, and records what it checked.

Once satisfied, the request goes to the certification authority, which issues the certificate. From then on the customer can sign and encrypt with it.

The value of every signature that customer ever makes traces back to that one check. If the RA accepted a false identity, the certificate is perfectly valid, cryptographically sound, and issued to the wrong person.

RA, CA and VA: who does what

The three authorities of a PKI get confused because their names differ by one word. They are separated by when they act.

The registration authority looks first. It checks the identity of the applicant, and that is all this entry describes.

The certification authority signs. It issues the certificate once the RA has accepted the identity, and it is the entity whose signature everybody else trusts. It has its own entry: certificate authority.

The validation authority answers afterwards, when somebody asks whether a certificate that was issued is still valid today.

In one line: the RA looks before, the CA signs, the VA answers after.

In small organisations all three functions are performed by the same product, and that does not make them the same function. They are three separate decisions and each fails in its own way: the RA fails by accepting a false identity, the CA fails by issuing what it should not have, and the VA fails when nobody checks revocation at all.