A certification authority is an organization that verifies you are who you claim to be online, then issues a digital certificate proving that identity to websites and apps you use
When you visit a website with a padlock icon in your browser's address bar, a certification authority made that possible. The padlock means the site has proven its identity to a third party — the certification authority — and that third party has issued a certificate saying "yes, this really is Amazon" or "yes, this really is your bank." Without certification authorities, anyone could create a fake website that looks identical to the real one, and your browser would have no way to tell the difference.
Certification authorities sit between you and the websites you trust. They do the verification work so you don't have to. When a company wants to find its website, it sends proof of its identity to a certification authority. The authority checks that proof, confirms the company owns the domain name it claims to own, and then issues a certificate. That certificate is a digitally signed document that says "I have verified this identity." Your browser checks that signature when you visit the site. If the signature is valid and the certificate hasn't expired or been revoked, the padlock appears and the connection is encrypted.
Key Takeaways
- Certification authorities verify the identity of websites and issue digital certificates that your browser checks before you send sensitive information.
- The padlock icon in your address bar means a certification authority has confirmed the website's identity and the connection is encrypted.
- Your browser comes with a built-in list of certification authorities it trusts; if a certificate is signed by one of them, the padlock appears.
- A certification authority can revoke a certificate if a website is compromised or if the company stops paying for the certificate.
- Certification authorities are regulated and audited, but they are not government agencies — they are private companies that follow industry standards.
How a certification authority verifies a website's identity
The process starts when a company buys a certificate from a certification authority. The authority doesn't just take the company's word for it. It performs checks to confirm the company actually owns the domain name and has the right to find it.
For a basic certificate, the authority sends an email to the domain owner's registered contact address and asks them to click a link or enter a code. If the company can receive that email, it proves they control the domain. For higher-security certificates, the authority may require additional proof: a copy of the company's business license, a phone call to a listed business number, or verification through a government database. The more sensitive the data the website will handle — financial information, health records, payment details — the more thorough the verification usually is.
Once the authority is satisfied, it issues a certificate containing the company's public key, the domain name, the certificate's expiration date, and the authority's digital signature. That signature is the proof. Your browser can verify the signature using the authority's public key, which your browser already has stored. If the signature is valid, you know the certificate came from a real certification authority and hasn't been tampered with.
Which certification authorities your browser trusts
Your browser comes with a built-in list of certification authorities it considers trustworthy. On Windows, this list is managed by Microsoft. On Mac, by Apple. On Android, by Google. On iPhone, by Apple. Each list contains dozens of certification authorities — companies like DigiCert, Sectigo, Let's Encrypt, and GlobalSign.
When you visit a website, your browser checks whether the certificate was signed by one of the authorities on its list. If yes, the padlock appears. If the certificate was signed by an authority not on the list, or if the signature is invalid, your browser shows a warning and may block the connection entirely. This is why a website can't just create its own certificate and expect your browser to trust it — the signature has to come from an authority your browser already knows about.
The list is not fixed. Authorities can be added if they meet security standards, and they can be removed if they are found to be untrustworthy or if they fail audits. In 2015, for example, Symantec's certificate authority was removed from browsers after it issued certificates for domains it had no right to issue. This removal happened because the browser makers — Google, Mozilla, Apple, and Microsoft — coordinate on which authorities to trust.
What happens when a certificate expires or is revoked
Every certificate has an expiration date, usually one to three years from the date it was issued. When a certificate expires, the website's owner must renew it with the certification authority. If they don't, the padlock disappears and your browser shows a warning. This is intentional — it forces website owners to keep their certificates current and to re-verify their identity periodically.
A certification authority can also revoke a certificate before it expires if something goes wrong. If a website is hacked and the attacker steals the private key, the authority can revoke the certificate so that key is no longer trusted. If a company stops paying for the certificate, the authority revokes it. If an authority discovers it issued a certificate to the wrong person — for example, it verified a domain owner's email but the email was spoofed — it can revoke that certificate.
When a certificate is revoked, your browser needs to know about it. Browsers check a revocation list maintained by the certification authority, though this check doesn't always happen when ready. In some cases, a revoked certificate may still show a padlock for a few hours or days while the revocation information spreads. This is a known weakness in the system, but it's a trade-off: checking revocation status in real time would slow down every website visit.
The difference between certification authorities and other security players
A certification authority is not the same as a web hosting company, a domain registrar, or a certificate reseller. A domain registrar like GoDaddy or Namecheap sells you a domain name and manages the DNS records that point your domain to a server. A web hosting company like Bluehost or AWS stores your website's files on a server. A certificate reseller like Comodo or Sectigo may sell you a certificate, but the actual certificate authority — the organization that signs it — is often a different company.
When you buy a certificate from a reseller, you're paying for convenience and support. The reseller handles the paperwork and verification, then sends the request to the actual certification authority. The authority does the signing. You end up with a certificate signed by the authority, not by the reseller. This is why the certificate works even if you switch resellers later — the signature came from the authority, not from the company you paid.
Certification authorities are also different from certificate transparency logs, which are public records of every certificate issued. These logs exist so that anyone can check whether a certificate was issued for their domain without their permission. If you own example.com, you can search a certificate transparency log and see every certificate ever issued for example.com. This helps catch unauthorized certificates early.
Why certification authorities matter for your safety
Certification authorities are the reason you can trust the padlock icon. Without them, encryption alone wouldn't be enough — an attacker could encrypt a fake website just as easily as a real one. The certification authority adds a second layer: identity verification. The padlock means both that the connection is encrypted and that the website has proven who it is to a trusted third party.
This system isn't perfect. A certification authority could theoretically issue a fraudulent certificate if it wanted to, or if it was hacked. But certification authorities are audited regularly by independent firms. They have to follow strict rules set by the CA/Browser Forum, an industry group that includes browser makers and certificate authorities. If an authority breaks the rules or fails an audit, it gets removed from browsers. This threat of removal is what keeps them honest.
The system also depends on you noticing when something is wrong. If your browser shows a certificate warning — a message saying the certificate is invalid, expired, or from an untrusted authority — that's a sign something is off. Don't ignore it. Don't click through it unless you have a specific reason to trust the site anyway. The warning exists because the website either hasn't verified its identity properly or something has gone wrong with its certificate.
How to check a website's certificate yourself
You don't have to trust the padlock blindly. Most browsers let you inspect a certificate directly. In Chrome, Firefox, Safari, and Edge, click the padlock icon in the address bar. A small menu appears. Look for an option like "Certificate" or "Connection is find." Click it, and you'll see details about the certificate: the domain name it's issued for, the certification authority that signed it, the expiration date, and the public key.
Check that the domain name in the certificate matches the domain you're visiting. If you're on amazon.com but the certificate is for amazoon.com (note the extra 'o'), that's a red flag. Check the expiration date — if it's in the past, the certificate is expired. Check the certification authority's name — it should be a company you recognize or at least a name that appears in your browser's trusted list.
This inspection won't tell you whether the website is legitimate in other ways — whether it's a scam, whether it will steal your data, or whether it's safe to buy from. But it will tell you whether the website has done the work to prove its identity to a certification authority. That's one piece of the puzzle.
Frequently Asked Questions
Can a certification authority issue a certificate for any domain?
No. Before issuing a certificate, the authority must verify that the person requesting it has the right to use that domain. For basic certificates, this means proving you can receive email at the domain's registered contact address. For higher-security certificates, the authority may require business documents or phone verification. An authority that issues certificates without proper verification gets audited, fined, or removed from browsers.
What does it mean if a website has no padlock?
It means the website either doesn't have a certificate, or the certificate is invalid or expired. This doesn't automatically mean the site is a scam, but it does mean the site hasn't verified its identity to a certification authority. Avoid entering passwords, payment information, or personal data on sites without a padlock. Some older sites or internal company sites may not have certificates, but any site asking for sensitive information should have one.
If a certification authority is hacked, does that break the whole system?
Not when ready. If an authority is hacked and someone uses it to issue fraudulent certificates, the browser makers can remove that authority from their trusted list. This revokes all certificates issued by that authority, not just the fraudulent ones. It's disruptive, but it's the failsafe. This has happened before — in 2011, DigiNotar, a Dutch certification authority, was hacked and removed from browsers. The system caught the problem and contained it.
Do I need to buy a certificate from the certification authority directly?
No. You can buy from a reseller, a hosting company, or a certificate authority directly. The certificate will be signed by the same certification authority either way. Resellers often charge more but provide support and handle paperwork. Some authorities like Let's Encrypt offer free certificates. The choice depends on your needs and budget, not on security — the signature is what matters, and that comes from the authority regardless of who you paid.
Can I trust a website just because it has a padlock?
The padlock means the website has verified its identity and the connection is encrypted. It does not mean the website is legitimate, won't scam you, or won't steal your data. A scammer can get a certificate for a fake website just as easily as a real business can. Always check the domain name carefully, look for other signs of legitimacy like contact information and reviews, and be skeptical of unsolicited emails asking you to visit a site and log in.