Certificate Authority (CA)
A certificate authority (CA) is the trusted party in a PKI that verifies a requester's identity or control of a name and then signs an X.509 certificate binding that name to a public key, so anyone who trusts the CA can trust the certificate. The certificate profile is defined in RFC 5280; publicly trusted TLS CAs must also follow the CA/Browser Forum Baseline Requirements and the root programs of browser and OS vendors.
| Public CA | Private (internal) CA | |
|---|---|---|
| Trusted by | Every browser and OS by default | Only devices you configure to trust its root |
| Examples | Let's Encrypt, DigiCert, Sectigo, GlobalSign | Microsoft AD CS, EJBCA, Smallstep, cloud private CAs |
| Rules | CA/Browser Forum; validity capped at 200 days since March 15, 2026 per Ballot SC-081v3 | Your own policy |
| Used for | Public websites and APIs | mTLS, devices, VPN, internal services, workload identity |
A CA hierarchy normally keeps the root offline and issues from intermediate CAs, so a compromised issuing CA can be revoked without replacing the root on every device. Issuance itself is increasingly automated through ACME or, for workloads, through SPIFFE implementations that run their own short-lived CA.
It matters for identity because a CA is a credential factory. Whoever can get a certificate issued for a privileged name can often authenticate as it: misconfigured Active Directory Certificate Services templates let an ordinary user request a certificate for a domain admin, which is the technique behind AD CS certificate template abuse. Treat issuing CAs and their templates as tier-zero assets, and inventory them as part of certificate lifecycle management.
See also: PKI, X.509, PKI vendors, open-source PKI and certificate management tools, machine identity
Related on Start with Identity
- BlogBrowsers block eight eMudhra intermediate CAs after their private keys are exposed
A researcher reported on October 17 that the private keys of eight eMudhra (emSign) intermediate CAs, six for TLS and two for code signing, were exposed (later
- PodcastSectigo
Short, frequent episodes on PKI, certificate policy, and post-quantum migration from two certificate industry veterans at Sectigo. 670 episodes and counting.
- GlossaryABAC
Attribute-Based Access Control. Access decisions are made by evaluating attributes of the subject, resource, action, and environment against policy. Flexible bu
- GlossaryAccess Certification
Periodic review of who has access to what, with managers or resource owners attesting that access is still appropriate. A regulatory requirement in many industr
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- BlogAkeyless ships Runtime Authority, authorising AI agents per action instead of per session
Agents hold no secrets and get no standing privilege. Every action is authorised at the moment it happens, and the audit trail links the originating prompt to t