What is a Certificate Authority (CA)?
A Certificate Authority (CA) is the body that issues digital certificates and, with its signature, guarantees that the certificate's information has been verified. The CA is the trust anchor in any PKI: without a trusted third party to vouch for the link between key and identity, a certificate would be no more than a claim anyone could make about themselves.
Before a public CA issues a certificate, it validates the applicant, for example by checking that you actually control the domain the certificate is to cover. The CA then signs the certificate with its own private key, and anyone can verify that signature.
How does the chain of trust work?
Trust is organised as a chain. At the top sits a root CA, whose certificate comes pre-installed in operating systems and browsers. The root CA signs one or more issuing CAs (intermediates), which issue the certificates for servers and users. When your browser encounters a certificate, it follows the chain upwards, link by link, until it reaches a root it knows.
The construction has a practical point: the root CA's key is so critical that it is kept offline and typically protected in an HSM, while the issuing CAs handle the daily work. If an intermediate is compromised, it can be revoked without losing the root, and with it the entire trust structure.
Public CA or your own internal CA?
Public CAs such as Let's Encrypt, DigiCert and Sectigo issue certificates the whole internet trusts, and they are subject to strict industry requirements. You use them for everything outward-facing: websites, APIs and email.
For internal needs, many companies run their own private CA, typically with Active Directory Certificate Services (see Microsoft Learn). It issues certificates for domain machines, Wi-Fi and VPN access and internal services, where only your own systems need to trust the root. The advantage is control and flexibility; the obligation is that you take over the CA's responsibilities yourself: secure key storage, documented processes and control of the certificate lifecycle. How to approach that in practice is covered in our e-book PKI and HSM in practice.
What happens if a CA is compromised?
If an attacker gets hold of a CA's private key, they can issue valid-looking certificates for arbitrary domains and thereby impersonate anyone. History has examples of public CAs that had to shut down after a compromise, because all trust in them evaporated. That is why all publicly issued certificates are today logged in Certificate Transparency logs, open registers where you can detect if someone issues certificates for your domains. The Danish Centre for Cyber Security generally highlights the protection of critical keys as a core element of robust IT security. The same logic applies to an internal CA: if the root is compromised, the entire hierarchy must be rebuilt and all certificates reissued.
How MI Support IT can help
We have many years of specialist experience with enterprise PKI, from designing CA hierarchies and securing root keys to daily operations and renewals. Read more under PKI Management, or contact us if you would like an assessment of your CA setup.