{"id":12689,"date":"2020-08-10T13:00:00","date_gmt":"2020-08-10T17:00:00","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=12689"},"modified":"2024-06-12T08:03:08","modified_gmt":"2024-06-12T12:03:08","slug":"what-is-a-certificate-authority-ca-and-what-do-they-do","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/what-is-a-certificate-authority-ca-and-what-do-they-do\/","title":{"rendered":"What Is a Certificate Authority (CA) and What Does It Do?"},"content":{"rendered":"\n

Every time you visit a website that starts with HTTPS, you\u2019re using a certificate authority. But what exactly is a CA and how does it make your transactions and communications more secure?<\/h2>\n\n\n\n

Certificate authorities (CA) are a critical part of the internet. If CAs didn\u2019t exist, you wouldn\u2019t be able to shop, pay taxes, or do banking online because the internet would be insecure. (Your web browser is actually using a certificate authority right now.)<\/p>\n\n\n\n

But what is a certificate authority, exactly? What does a certificate authority do? And how do certificate authorities work?<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n

What we’re hashing out…<\/p>

<\/polyline><\/svg><\/div>
  1. Every time you visit a website that starts with HTTPS, you\u2019re using a certificate authority. But what exactly is a CA and how does it make your transactions and communications more secure?<\/a>
      <\/ol><\/li>
    1. What Is a Certificate Authority (CA)?<\/a>
      1. Certificate Authorities Are Like Passport Authorities for the Internet<\/a>
          <\/ol><\/li><\/ol><\/li>
        1. How a Certificate Authority Works: The Technical Details<\/a>
            <\/ol><\/li>
          1. What Does a Certificate Authority Do? Breaking Down the Functions of a CA<\/a>
            1. Verification<\/a>
                <\/ol><\/li>
              1. Digital Certificates<\/a>
                1. SSL\/TLS Certificates<\/a>
                  1. Types of SSL\/TLS Certificates<\/a>
                      <\/ol><\/li><\/ol><\/li>
                    1. Code Signing Certificates<\/a>
                        <\/ol><\/li>
                      1. Email Signing Certificates<\/a>
                          <\/ol><\/li>
                        1. Document Signing Certificates<\/a>
                            <\/ol><\/li><\/ol><\/li>
                          1. Digital Signatures<\/a>
                              <\/ol><\/li>
                            1. A Certificate Authority\u2019s Role in the Chain of Trust<\/a>
                                <\/ol><\/li>
                              1. A CA\u2019s Role in Certificate Revocation<\/a>
                                  <\/ol><\/li><\/ol><\/li>
                                1. Why Certificate Authorities Are So Important<\/a>
                                    <\/ol><\/li>
                                  1. But Just How Many CAs Are There?<\/a>
                                    1. The Differences Between a Public Certificate Authority and a Private CA<\/a>
                                      1. What Is a Trusted CA (and Why Do We Trust Them)?<\/a>
                                          <\/ol><\/li>
                                        1. What Is a Private CA?<\/a>
                                            <\/ol><\/li><\/ol><\/li>
                                          1. Who Decides Which Certificate Authorities Are Publicly Trusted?<\/a>
                                              <\/ol><\/li><\/ol><\/li>
                                            1. Final Thoughts on Certificate Authorities and Why They Matter<\/a>
                                                <\/ol><\/li><\/ol><\/div>\n\n\n\n

                                                What Is a Certificate Authority (CA)?<\/h2>\n\n\n\n

                                                A certificate authority, also known as a certification authority, is a trusted organization that verifies websites (and other entities) so that you know who you\u2019re communicating with online. Their objective is to make the internet a more secure place for organizations and users alike. This means that they play a pivotal role in digital security.<\/p>\n\n\n\n

                                                If that sounded slightly nebulous or confusing, let\u2019s use an example to explain what a certificate authority is. Let\u2019s say you\u2019re visiting your bank\u2019s website, bbt.com:<\/p>\n\n\n\n

                                                \"Screenshot
                                                Here\u2019s a screenshot that shows how bbt.com displays in the Google Chrome browser<\/figcaption><\/figure><\/div>\n\n\n\n

                                                If you\u2019re familiar with how the internet works, you know that things are not always as they seem. The website looks like bbt.com, and the domain says that it\u2019s bbt.com\u2026 but how do you know<\/em> that you\u2019re actually connected to a server that\u2019s run by BB&T? How do you know it\u2019s not a hacker who built a website that looks just like bbt.com? For hacker geniuses, that\u2019d be pretty easy to do \u2014 here\u2019s a recent example of this kind of attack:<\/p>\n\n\n\n

                                                \"A
                                                A screenshot of a tweet by MyEtherWallet<\/a> that talks about an imposter phishing website.<\/figcaption><\/figure><\/div>\n\n\n\n

                                                So how do you know you\u2019re connected to the real website? That\u2019s a certificate authority\u2019s job \u2014 they verify websites\/organizations so that you know who you\u2019re communicating with online. (This way, you don\u2019t accidentally send your credit card number to a hacker in Timbuktu.) So, if we look at the SSL\/TLS certificate details for bbt.com, we can see that the website has been verified by DigiCert Inc. This means that DigiCert is the certificate authority that verified BB&T\/bbt.com so you can be 100% confident that you\u2019re connected with the official BB&T website:<\/p>\n\n\n\n

                                                \"A
                                                Here\u2019s a screenshot that shows how the certificate information displays in the Google Chrome browser.<\/figcaption><\/figure><\/div>\n\n\n\n
                                                \"A
                                                Here\u2019s a screenshot that shows how the certificate information displays in the Firefox browser.<\/figcaption><\/figure><\/div>\n\n\n\n

                                                Certificate Authorities Are Like Passport Authorities for the Internet<\/h3>\n\n\n\n

                                                If you\u2019ve ever gotten a passport to travel internationally, you probably remember the verification process that you went through to prove that you are who you claimed to be. (It probably included some legal papers, photo ID, and maybe fingerprints.)<\/p>\n\n\n\n

                                                Once you got your passport, you could use it to prove to anyone that you\u2019re really you. (Even if they\u2019d never met you before.)<\/p>\n\n\n\n

                                                Certificate authorities are like that \u2014 but for websites and online activities. Just like the passport office, a certificate authority charges a small fee to complete the verification process and issue the certificate. In this case, after they verify a website (or organization), they issue what\u2019s known as a digital certificate. This digital file enables organizations, websites, or other entities to prove who they are \u2014 that they\u2019re the real deal.<\/p>\n\n\n\n

                                                So how does all of this work? After all, websites don\u2019t have actual passports, and I don\u2019t remember scanning any passports when I visit my bank\u2019s website\u2026<\/p>\n\n\n\n

                                                Let\u2019s dive into this topic in more detail.<\/p>\n\n\n\n

                                                How a Certificate Authority Works: The Technical Details<\/h2>\n\n\n\n

                                                Certificate authorities are one of the integral parts that make up a larger system called public key infrastructure<\/a>, or PKI for short. If you want to read more about how it works, see our article that offers a deep dive on how PKI works<\/a>. But for now, let\u2019s just give a quick overview before moving on. To keep things simple, we\u2019ll keep talking about how PKI works with websites.<\/p>\n\n\n\n

                                                When you go to a website and see the padlock (or the security details like we showed above for bbt.com), the technology that\u2019s enabling that is an SSL certificate (or, more accurately, a TLS certificate, but you can use either term).<\/p>\n\n\n\n

                                                SSL\/TLS certificates are based on PKI, and there are a few key parts that need to be in place for the SSL certificate to work:<\/p>\n\n\n\n