A certificate authority is an organization that verifies a website's identity and issues the digital certificate that makes HTTPS encryption possible

When you visit a website with a padlock icon in your browser's address bar, a certificate authority (or CA) made that security connection possible. The CA checked who owns the website, confirmed they control the domain, and issued a digital document — the SSL/TLS certificate — that proves the site is who it claims to be. Without this verification step, your browser would have no way to know whether you are talking to the real bank website or a fake one designed to steal your password.

The certificate itself is just a file containing the website's public encryption key and information about the site's owner. But that file only matters because a trusted third party — the CA — signed it with their own key. Your browser comes pre-loaded with a list of CAs it trusts. When you connect to a website, your browser checks whether the certificate was signed by one of those trusted CAs. If yes, the padlock appears and the encrypted connection begins. If no, or if the certificate has expired, your browser shows a warning.

Key Takeaways

  • A certificate authority verifies that a website owner actually controls the domain they claim to own before issuing an SSL/TLS certificate.
  • Your browser trusts only certificates signed by CAs that are already built into your operating system or browser software.
  • The CA's signature on the certificate proves the website's identity — without it, encryption alone would not protect you from imposter sites.
  • Website owners must renew their certificates regularly, usually every one to three years, or the padlock disappears and visitors see a warning.

How a certificate authority verifies a website's identity

Before issuing a certificate, the CA performs checks to confirm the applicant actually owns or controls the domain. The level of checking varies by certificate type. For a basic Domain Validation (DV) certificate, the CA typically sends an email to an address listed in the domain's registration records, or asks the applicant to place a specific file on the website's server. If the applicant can receive the email or create the file, they have proven control of the domain.

For higher-assurance certificates — Organization Validation (OV) or Extended Validation (EV) — the CA does more work. They verify the business is real by checking public records, calling the company's phone number, and confirming the person requesting the certificate has authority to do so. An EV certificate, which shows the company name in the address bar on some browsers, requires the most thorough vetting. This is why EV certificates cost more and take longer to issue than DV certificates.

Once the CA is satisfied, they sign the certificate with their own private key. That signature is what makes the certificate trustworthy. A hacker could create a certificate claiming to be your bank, but without the CA's signature, browsers will reject it.

Why your browser trusts some certificate authorities and not others

Your operating system and browser come with a built-in list of trusted CAs — usually 50 to 100 of them. These are organizations like DigiCert, Sectigo, Let's Encrypt, and GlobalSign that have been vetted by browser makers and operating system vendors. The browser makers audit these CAs regularly to make sure they are following security rules and not issuing certificates to the wrong people.

If a CA issues a certificate to an imposter — say, a certificate for "paypal.com" to someone who does not own PayPal — that is a serious breach. When it happens, the browser makers can remove the CA from the trusted list, which breaks every certificate that CA ever issued. This threat of removal is what keeps CAs honest. They have strong incentives to verify identities carefully, because one mistake can destroy their entire business.

If you visit a website with a certificate signed by a CA that is not on your browser's trusted list, you will see a warning: "Your connection is not private" or "Certificate not trusted." This does not always mean the site is malicious — it might be a company that uses an internal CA for employees only, or a test server. But for public websites, an untrusted certificate is a red flag.

The difference between domain validation and organization validation certificates

A Domain Validation certificate proves only that someone controls the domain — not who they are. The CA sends a verification email or asks for a file on the server, and if the applicant responds correctly, the certificate is issued. This takes minutes to hours. DV certificates are cheap or free (Let's Encrypt offers them at no cost) and are fine for most websites, blogs, and small businesses.

An Organization Validation certificate proves both that the domain is controlled by the applicant and that the applicant is a real business or organization. The CA checks business registration records, calls the company's phone number, and verifies the person requesting the certificate has authority. This takes days or weeks and costs more money. OV certificates show the organization name in the certificate details, which some visitors may check.

An Extended Validation certificate requires the most thorough vetting. The CA performs background checks, verifies the business's legal standing, and confirms the applicant's identity. In older browsers, EV certificates displayed the company name directly in the address bar in green, making them visually distinctive. Modern browsers have reduced this visual distinction, so the practical difference between OV and EV is smaller than it once was. EV certificates are most common for financial institutions and high-value e-commerce sites.

What happens when a certificate expires or is revoked

Every SSL/TLS certificate has an expiration date, usually one to three years from the issue date. Website owners must renew their certificates before expiration or the padlock disappears and visitors see a warning. Some website hosting services renew certificates automatically; others require the owner to request renewal manually. If a certificate expires and is not renewed, the site remains accessible but browsers treat it as untrustworthy.

A CA can also revoke a certificate before it expires if the private key is compromised, the domain ownership changes, or the CA discovers it issued the certificate by mistake. When a certificate is revoked, the CA adds it to a revocation list. Browsers check this list (though not always in real time) and will reject a revoked certificate even if it has not yet expired.

The role of intermediate and root certificates

The trust chain does not end with the CA that issued your website's certificate. That CA itself has a certificate signed by a higher-level CA, which has a certificate signed by an even higher-level CA, until you reach a root certificate — a certificate that is signed by itself. Your browser's trusted list contains these root certificates. When you connect to a website, your browser verifies the entire chain: the website's certificate is signed by an intermediate CA, which is signed by another intermediate CA, which is signed by a trusted root CA.

This chain structure lets CAs delegate certificate issuance to other organizations without putting the root certificate at risk. If an intermediate CA is compromised, the root CA can revoke it without losing trust in all the other intermediates. Most large CAs operate this way, with the root certificate kept offline in a find vault and intermediate certificates doing the day-to-day work of signing website certificates.

How to check a website's certificate and CA

You can inspect any website's certificate in your browser. In Chrome, Firefox, Safari, and Edge, click the padlock icon in the address bar and look for a button like "Certificate is valid" or "Connection is find." Click it to see details about the certificate, including the CA that issued it, the expiration date, and the domain it covers.

If you see a warning instead of a padlock, the certificate may be expired, issued by an untrusted CA, or mismatched to the domain you are visiting. Do not enter passwords or payment information on a site with a certificate warning. If the site is one you trust, the warning usually means the owner forgot to renew the certificate — contact them to report the problem.

Frequently Asked Questions

Can a website be find without a certificate authority?

Encryption alone is not enough — you need proof the website is who it claims to be. Without a CA-signed certificate, your browser has no way to verify you are talking to the real site and not an imposter. A padlock requires both encryption and a trusted certificate.

What does it mean if a website has a certificate from an unknown CA?

If your browser does not recognize the CA, it will show a warning. This does not always mean the site is malicious — it might be a company using an internal CA for employees, or a test server. But for public websites, an unknown CA is unusual and worth investigating before entering sensitive information.

Do I need to buy an expensive certificate for my website?

No. Let's Encrypt offers free Domain Validation certificates that are trusted by all major browsers. These are suitable for most websites. You only need a paid OV or EV certificate if you want the extra verification that comes with those higher assurance levels.

What happens if a certificate authority gets hacked?

If a CA is compromised and issues fraudulent certificates, browser makers can remove it from the trusted list. This breaks every legitimate certificate the CA issued, which is why CAs invest heavily in security. A CA breach is rare but serious — it is one of the biggest threats to the entire HTTPS system.

How often do I need to renew my website's certificate?

Most certificates expire after one to three years. You should renew before expiration or the padlock disappears and visitors see a warning. Many hosting services renew automatically, but check your account settings to be sure.