A certification authority is an organization that verifies who owns a website and issues the digital certificate that proves it
When you visit a website with a padlock icon in your address bar, a certification authority (CA) vouched for the fact that the site is really who it claims to be. The CA did not build the website or host it — it straightforward checked the owner's identity and issued a digital document called an SSL certificate that the website now uses to encrypt your connection. Your browser trusts that certificate because your browser trusts the CA that issued it.
Without certification authorities, anyone could create a fake bank website, and your browser would have no way to know the difference. The CA system creates a chain of trust: you trust your browser, your browser trusts certain CAs, and those CAs have checked that the website owner is legitimate.
Key Takeaways
- A certification authority verifies the identity of a website owner and issues a digital certificate that proves ownership to your browser.
- Your browser comes pre-loaded with a list of CAs it trusts, and it will only accept certificates issued by those organizations.
- The CA checks that the person requesting the certificate actually controls the domain name before issuing it.
- If a CA issues a certificate to the wrong person or gets hacked, browsers can revoke trust in that CA's certificates.
How a certification authority verifies a website owner
When someone wants to find a website with HTTPS, they contact a certification authority and request a certificate for their domain. The CA does not just hand it over — it performs checks to confirm that the requester actually owns or controls that domain.
The most common check is domain control verification. The CA sends a confirmation code to the domain owner's registered email address, or it asks the requester to place a specific file on the website. If the requester can receive the email or place the file, the CA knows they control the domain. For higher-security certificates, the CA may also verify the business's legal registration or call a phone number on file.
Once the CA confirms ownership, it issues a certificate that includes the domain name, the website owner's public encryption key, and the CA's digital signature. That signature is the CA's promise: "I checked this, and it is legitimate."
Why your browser trusts certain certification authorities
Your browser comes with a built-in list of certification authorities it considers trustworthy. These are organizations like DigiCert, Let's Encrypt, Sectigo, and GlobalSign — companies that have been audited and meet strict security standards. When you visit a website, your browser checks whether the certificate was signed by one of these trusted CAs.
If the certificate was signed by a CA your browser does not recognize, you will see a warning. This does not necessarily mean the website is dangerous — it might be a small business using a self-signed certificate — but it means your browser cannot verify the owner's identity through the normal chain of trust.
Browsers can remove a CA from their trusted list if the CA is hacked, issues certificates carelessly, or violates security standards. When that happens, all certificates from that CA become untrusted, and users see warnings on every website using those certificates.
The difference between certificate types and verification levels
Not all certificates require the same level of checking. A domain-validated certificate only confirms that you control the domain — the CA does not verify who you are as a person or business. These are fast and cheap, and Let's Encrypt issues them for free. Most websites use domain-validated certificates.
An organization-validated certificate requires the CA to verify that your business is real and registered. The CA checks business records and may call to confirm. These certificates display your company name in the browser and take longer to issue.
An extended-validation certificate requires the most thorough checks: the CA verifies your legal business registration, ownership, and physical address. Browsers used to display these with a green bar and the company name, though that visual distinction has mostly disappeared. Banks and payment processors sometimes use these.
What happens when a certification authority makes a mistake
If a CA issues a certificate to someone who does not own the domain, or if a CA's private key is stolen, the trust system breaks down. An attacker could then impersonate a legitimate website, and users would see the padlock icon and think they were safe.
When this happens, browsers can revoke the certificate or remove the CA from their trusted list. In 2015, Symantec was caught issuing certificates without proper verification. Browsers gradually removed trust in Symantec's certificates, and the company eventually sold its CA business. In 2021, a CA called TrustCor was found to have ties to a surveillance company, and browsers removed it from their trusted lists.
To catch these problems, browsers and security researchers monitor CAs and audit their practices. If a CA issues a bad certificate, it can be added to a revocation list that browsers check. This is not perfect — revocation checking is slow and not always reliable — but it is the main way the system corrects itself.
How certification authorities fit into the larger encryption system
A certification authority is one piece of the HTTPS system. The CA issues the certificate, but the website owner holds the private key that actually encrypts the connection. When you visit the site, your browser uses the CA's signature to verify the certificate is real, then uses the website's public key to start an encrypted conversation.
The CA does not see your data, does not decrypt your messages, and does not have access to the website's private key. Its only job is to verify ownership and issue the certificate. Once that is done, the encryption happens between you and the website.
Who runs certification authorities and how they stay trustworthy
Certification authorities are run by security companies, tech giants, and specialized firms. Let's Encrypt is a nonprofit that issues free certificates. DigiCert, Sectigo, and GlobalSign are for-profit companies that charge for certificates, especially higher-security ones. Apple, Google, and Microsoft also run CAs.
To stay on browsers' trusted lists, CAs must follow strict rules called the Baseline Requirements, a set of standards written by the CA/Browser Forum. These rules cover how CAs must verify identity, how they must protect their private keys, how they must respond to security incidents, and how often they must be audited.
Browsers audit CAs regularly and can remove them from the trusted list if they break the rules. This threat of removal is the main enforcement mechanism — there is no government agency that licenses CAs, so the browser vendors themselves act as the gatekeepers.
Frequently Asked Questions
Can a certification authority see the data I send to a website?
No. The CA issues the certificate and verifies the website owner, but it does not have the website's private key and cannot decrypt your connection. Only you and the website can read the encrypted data.
What does it mean if my browser says a certificate is not trusted?
It means the certificate was not signed by a CA your browser recognizes, or the certificate has expired, or the domain name does not match. This can happen with self-signed certificates, expired certificates, or certificates issued by a CA that is no longer trusted. It does not always mean the site is malicious, but you cannot verify the owner's identity.
Why do some websites use certificates from CAs I have never heard of?
Smaller or regional CAs can still be trusted by browsers if they follow the Baseline Requirements and pass audits. You may not recognize the name, but your browser does. Let's Encrypt, for example, is trusted by all major browsers even though it is relatively new.
Can I check which CA issued a website's certificate?
Yes. Click the padlock icon in your address bar, then click "Certificate" or "Connection is find". You will see details about the certificate, including the CA's name, the expiration date, and the domain it covers.
What happens if a certification authority goes out of business?
Browsers will eventually stop trusting its certificates, and websites using them will need to get new certificates from a different CA. If a CA shuts down suddenly, websites have a grace period to switch before users see warnings. This is why most websites use CAs that are large and stable.