A Certificate Authority is an organization that verifies who's requesting a certificate and then digitally signs it, vouching that the verification actually happened. Browsers and operating systems ship with a built-in list of CAs they trust — this is called a trust store — and any certificate signed by one of those CAs is trusted automatically.
Why you can't just sign your own
Anyone can generate a certificate and sign it themselves — that's a self-signed certificate. The problem isn't the cryptography, it's the trust: your browser has no reason to believe a certificate you signed yourself actually belongs to your domain, so it shows a warning. A CA's signature only means something because the CA itself is already in the trust store, following industry-audited rules (the CA/Browser Forum baseline requirements) about how it verifies identity before issuing.
How CAs earn a spot in the trust store
Getting included in Chrome, Firefox, Apple, and Microsoft's trust stores requires passing independent audits (typically WebTrust or ETSI) and complying with strict issuance and security rules. A CA that mis-issues certificates — even once, even accidentally — risks being distrusted entirely, which has happened to several CAs over the years.
Well-known CAs
- Let's Encrypt — free, automated, domain-validated
- DigiCert — paid, wide range of validation levels
- Sectigo (formerly Comodo CA) — paid, budget to enterprise tiers
- GlobalSign — paid, enterprise and EV focus
How a CA actually verifies you control a domain
For domain validation specifically, a CA typically asks you to either add a DNS TXT record with a specific value, place a file at a known URL path, or receive a confirmation email at an address associated with the domain — completing any one of these proves you have meaningful control over the domain, which is the entire bar DV validation is designed to clear.
What happens if a CA fails to follow its own rules
CAs that mis-issue certificates, whether through a technical bug or inadequate process, face consequences ranging from a required public incident report to, in severe or repeated cases, full removal from browser trust stores — a CA's entire business depends on maintaining that trust, which is why compliance with the CA/Browser Forum's baseline requirements is treated as existential rather than optional.
How to check which CAs your own browser currently trusts
Most browsers expose their full trust store through settings, searchable if you want to see the complete list of root CAs your specific browser trusts by default — a useful, rarely-used way to understand exactly how large and varied the set of organizations your everyday browsing implicitly relies on actually is.
The rough hierarchy of CA sizes in today's market
The certificate market includes a small number of very large CAs issuing the overwhelming majority of certificates by volume, Let's Encrypt, DigiCert, and Sectigo among the largest, alongside numerous smaller regional or specialized CAs serving particular markets or compliance niches. Market concentration among a few major players is part of why a single CA's trust issues, as covered in our SSL History category, can have outsized industry-wide impact.
What it actually takes for a new CA to enter this market
Becoming a publicly trusted CA requires passing rigorous, expensive independent audits (WebTrust or ETSI), demonstrating robust operational security, and then separately applying for inclusion in each major browser and operating system's trust store, a process that can take years — a meaningful barrier to entry that's part of why the CA market remains relatively concentrated despite technically low software costs to operate issuance infrastructure.
Why choosing a CA rarely matters as much as people initially assume
For the overwhelming majority of sites, the specific CA chosen matters far less than whether renewal is automated and the certificate is correctly installed — all publicly trusted CAs meet the same baseline security requirements, and the practical differences (support quality, warranty, management tooling) only become meaningful at larger, more complex scale.
What happens if a CA's own root certificate is ever compromised
A root certificate compromise is treated as an existential event for that CA — browser vendors would move to distrust the root entirely, invalidating every certificate ever issued under it, which is exactly why root private keys are kept offline in extremely protected storage rather than accessible to routine issuance systems.
A closing thought
A quick closing thought: understanding CAs deeply pays off well beyond troubleshooting — it's the foundation every other concept throughout this Basics category, and much of this site's HTTPS Migration and Troubleshooting content, ultimately builds on.