# certificate-authority

Source: https://startwithidentity.com/glossary/certificate-authority/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

A certificate authority (CA) is the trusted party in a [PKI](https://startwithidentity.com/glossary/pki/) that verifies a requester's identity or control of a name and then signs an [X.509](https://startwithidentity.com/glossary/x509/) certificate binding that name to a public key, so anyone who trusts the CA can trust the certificate. The certificate profile is defined in [RFC 5280](https://www.rfc-editor.org/rfc/rfc5280); publicly trusted TLS CAs must also follow the CA/Browser Forum Baseline Requirements and the root programs of browser and OS vendors.

| | Public CA | Private (internal) CA |
|---|---|---|
| Trusted by | Every browser and OS by default | Only devices you configure to trust its root |
| Examples | [Let's Encrypt](https://startwithidentity.com/vendors/pki/lets-encrypt/), [DigiCert](https://startwithidentity.com/vendors/pki/digicert/), [Sectigo](https://startwithidentity.com/vendors/pki/sectigo/), [GlobalSign](https://startwithidentity.com/vendors/pki/globalsign/) | Microsoft AD CS, [EJBCA](https://startwithidentity.com/vendors/pki/ejbca/), [Smallstep](https://startwithidentity.com/vendors/pki/smallstep/), cloud private CAs |
| Rules | CA/Browser Forum; validity capped at 200 days since March 15, 2026 per [Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) | Your own policy |
| Used for | Public websites and APIs | [mTLS](https://startwithidentity.com/glossary/mtls/), devices, VPN, internal services, workload identity |

A CA hierarchy normally keeps the root offline and issues from intermediate CAs, so a compromised issuing CA can be revoked without replacing the root on every device. Issuance itself is increasingly automated through [ACME](https://startwithidentity.com/glossary/acme/) or, for workloads, through [SPIFFE](https://startwithidentity.com/glossary/spiffe/) implementations that run their own short-lived CA.

It matters for identity because a CA is a credential factory. Whoever can get a certificate issued for a privileged name can often authenticate as it: misconfigured Active Directory Certificate Services templates let an ordinary user request a certificate for a domain admin, which is the technique behind [AD CS certificate template abuse](https://startwithidentity.com/techniques/adcs-certificate-template-abuse/). Treat issuing CAs and their templates as tier-zero assets, and inventory them as part of [certificate lifecycle management](https://startwithidentity.com/glossary/certificate-lifecycle/).

See also: [PKI](https://startwithidentity.com/glossary/pki/), [X.509](https://startwithidentity.com/glossary/x509/), [PKI vendors](https://startwithidentity.com/vendors/pki/), [open-source PKI and certificate management tools](https://startwithidentity.com/articles/top-6-open-source-pki-certificate-management-tools/), [machine identity](https://startwithidentity.com/glossary/machine-identity/)