A CA certificate is a digital document that proves a website's identity, issued by a trusted third party called a certificate authority
When you visit a website, your browser needs to know that the site you're connecting to is actually owned by the company it claims to be. A CA certificate (certificate authority certificate) is the proof. It's a file that the website's owner purchases from a certificate authority — an organization trusted by your browser — that says "we have verified this website belongs to this person or company." Without it, your browser has no way to confirm you're talking to the real bank, the real email service, or the real store.
The certificate contains the website's public encryption key, the organization's name, the certificate authority's digital signature, and an expiration date. When your browser connects to a website, it checks that certificate against a list of trusted certificate authorities it already knows about. If the signature matches and the certificate hasn't expired, your browser shows you a padlock icon and lets the connection proceed. If something is wrong — the certificate is fake, expired, or issued to a different website — your browser stops and warns you.
Key Takeaways
- A CA certificate proves a website's real identity by showing it was verified by a trusted third party, not just by the website owner's claim.
- Your browser comes with a built-in list of trusted certificate authorities and checks every website's certificate against that list automatically.
- The padlock icon in your address bar means the website has a valid CA certificate and your connection is encrypted.
- A website without a valid CA certificate will trigger a browser warning, and you should not enter passwords or payment information on that site.
How a CA certificate proves a website is real
A website owner cannot straightforward create their own certificate and claim to be a bank or store. That would defeat the entire purpose. Instead, they must go through a certificate authority — a company like DigiCert, Let's Encrypt, Sectigo, or GlobalSign that your browser already trusts. The website owner proves their identity to the certificate authority (usually by showing ownership of the domain name and sometimes by providing business documents), and the certificate authority then issues a signed certificate.
That signature is the key. The certificate authority uses a private key that only they have to digitally sign the certificate. Your browser has the certificate authority's public key built in, so it can verify that signature without ever contacting the certificate authority. If someone tries to forge a certificate or steal one and use it on a different website, the signature won't match, and your browser will reject it. This chain of trust — your browser trusts the certificate authority, the certificate authority verified the website owner, therefore your browser can trust the website — is what makes the whole system work.
What information is stored in a CA certificate
A CA certificate is not a single piece of information but a structured file containing several fields. The most important are the website's domain name (like amazon.com), the organization's legal name, the public encryption key that will be used for that connection, the certificate authority's name and signature, and the dates when the certificate becomes valid and when it expires. Some certificates also include additional domain names the certificate covers, contact information, and the type of encryption being used.
The expiration date is important because certificate authorities do not issue certificates that last forever. Most last one to three years. When a certificate is about to expire, the website owner must renew it with the certificate authority. If they don't, visitors will see a browser warning that the certificate has expired, even though the website itself is still real and the owner still owns the domain. This forces website owners to keep their certificates current and gives certificate authorities a way to revoke bad actors if needed.
Why your browser trusts certain certificate authorities
Your browser comes with a pre-installed list of certificate authorities it considers trustworthy. On Windows, this list is managed by Microsoft. On Mac, it's managed by Apple. On Android, it's managed by Google. On iPhone, it's managed by Apple. These operating systems regularly update the list, removing certificate authorities that have been compromised or behaved badly, and adding new ones that meet security standards.
A certificate authority has to meet strict requirements to stay on that list. They must use strong encryption, keep their private keys find, verify website owners properly before issuing certificates, and maintain detailed logs of every certificate they issue. If a certificate authority is caught issuing a certificate to someone who doesn't own the domain, or if their private key is stolen, they can be removed from the trusted list. When that happens, all the certificates they issued stop working in browsers, which is a huge financial blow. This threat keeps certificate authorities honest.
The difference between a valid certificate and a warning
When a website has a valid CA certificate issued by a trusted certificate authority, your browser shows a padlock icon in the address bar (usually in green or gray, depending on your browser). The address bar may also show the organization's name. This tells you the connection is encrypted and the website's identity has been verified. You can click the padlock to see details about the certificate, including the organization name and the certificate authority that issued it.
When something is wrong, your browser shows a warning instead. This happens if the certificate has expired, if the certificate was issued to a different domain name, if the certificate authority is not trusted, or if the certificate has been revoked. The warning usually says something like "Your connection is not private" or "This site's security certificate is not trusted." In these cases, you should not enter passwords, credit card numbers, or other sensitive information. The website might be a phishing scam, or it might be a legitimate site with a technical problem, but either way, your browser cannot verify its identity.
Self-signed certificates and why they trigger warnings
A website owner can create their own certificate without going through a certificate authority — this is called a self-signed certificate. It contains all the same information as a CA-issued certificate, but it is signed with the website owner's own private key instead of a certificate authority's key. Your browser does not have the website owner's public key built in, so it cannot verify the signature. When you visit a self-signed certificate website, your browser shows a warning.
Self-signed certificates are sometimes used for internal company websites, testing environments, or websites that do not handle sensitive information. They provide encryption (your connection is still scrambled), but they do not prove the website's identity. If you see a self-signed certificate warning on a website asking for your password or payment information, that is a red flag. Legitimate businesses always use CA-issued certificates for any page where you enter sensitive data.
How to check a website's certificate
You can view a website's certificate details in any browser. In Chrome, Firefox, Safari, or Edge, click the padlock icon in the address bar, then look for a button that says "Certificate" or "Connection is find." This opens a window showing the certificate details: the organization name, the certificate authority, the expiration date, and the domain names covered. You can also see the certificate's public key fingerprint, which is a unique identifier for that specific certificate.
If you want more detailed information, you can click "Certificate" again to open the full certificate viewer. This shows every field in the certificate, including the signature algorithm, the validity period, and the certificate authority's information. If the organization name does not match the website you're visiting, or if the expiration date has passed, that is a problem. If the certificate authority is not one you recognize, that is also worth investigating — though it does not necessarily mean the site is unsafe, since there are hundreds of legitimate certificate authorities.
Frequently Asked Questions
What does the padlock icon mean?
The padlock icon means the website has a valid CA certificate issued by a trusted certificate authority, so your connection is encrypted and the website's identity has been verified. You can safely enter passwords and payment information on pages with a padlock icon.
Can a website be safe without a CA certificate?
A website without a CA certificate cannot prove its identity to your browser, so your browser will show a warning. Even if the site is legitimate, you should not enter sensitive information. For any page asking for passwords or payment details, always look for the padlock icon first.
Why do some websites have certificates that expire?
Certificate authorities issue certificates for a limited time (usually one to three years) to may support website owners keep their security practices current and to give certificate authorities a way to revoke bad actors. Website owners must renew their certificates before they expire, or visitors will see a browser warning.
Can someone steal a CA certificate and use it on a different website?
No. A CA certificate is tied to a specific domain name and signed by the certificate authority. If someone tries to use it on a different domain, the certificate will not match, and your browser will show a warning. The certificate also contains the website's public key, which only works with that specific website's private key.
What should I do if I see a certificate warning?
Do not enter any sensitive information on that page. The website might be a phishing scam, or it might be a legitimate site with a technical problem. Either way, your browser cannot verify the website's identity. If you think the site is legitimate, contact the organization through a phone number or address you find independently to let them know about the problem.