Infrastructure & Operations
What Is Certificate Authority (CA)?
A Certificate Authority (CA) is the trusted entity that issues digital certificates: it verifies that an applicant controls a domain or identity, then signs a certificate binding that identity to a public key. Browsers and operating systems ship a curated list of trusted root CAs, and every certificate you rely on chains back to one of them.
How CA trust works
Trust is hierarchical: a root CA (kept offline, extremely protected) signs intermediate CAs, which sign end-entity certificates. When your browser sees a site certificate, it builds the chain to a root it already trusts and validates every signature, validity period and revocation status along the way. The root store operators — Mozilla, Microsoft, Apple, Google — police CAs through audits (WebTrust/ETSI) and can distrust a CA entirely, as happened to Symantec in 2018.
Public and private CAs
Public CAs (Let’s Encrypt, DigiCert, Sectigo and others) issue certificates trusted by browsers, under the CA/Browser Forum Baseline Requirements — domain validation, certificate transparency logging, 398-day maximum validity. Private CAs (typically ADCS in Windows environments) issue certificates for internal use where the organization controls the trust store: machines, users, internal services. The trust obligations are the same; only the audience differs.
When a CA is compromised
A compromised CA can issue valid-looking certificates for anyone — which is why CA keys live in HSMs, root keys stay offline, issuance is logged in public Certificate Transparency logs, and revocation (CRL/OCSP) exists to withdraw trust quickly. For an internal CA the same logic applies: if the root is compromised, the entire hierarchy is rebuilt and every certificate reissued. Ceremony discipline and revocation health are not bureaucracy; they are the recovery plan.
Try it yourself — free tools
- Certificate Checker — see the full chain from any certificate to its root CA
- CRL Checker — check the health of a CA’s revocation list
- OCSP Checker — query a CA’s OCSP responder for live status
How MI Support IT can help
MI Support IT designs and operates private CA hierarchies — ADCS architecture, offline roots, key ceremonies and the CP/CPS documentation auditors expect. Read about our PKI services or get in touch.
PKI Glossary
- Certificate Chain (Intermediate Certificates)How leaf, intermediate and root certificates link together — and why a missing intermediate breaks TLS.
- Active Directory Certificate Services (ADCS)Microsoft's built-in CA platform for issuing and managing certificates inside a Windows/Active Directory environment.
- Certificate Revocation List (CRL)The CA-signed list of revoked certificates — and the single file whose expiry can take down an entire PKI.
- Browse all terms →