a certificate authority

If a certificate is a passport for a public key, then a certificate authority (CA) is the passport office — the trusted organization that checks who you are and then issues and stamps the document. The whole system hinges on trusting these issuers: your browser and operating system ship with a built-in list of CAs they trust, and a certificate is believed only if it was signed by one of them (or by someone that one of them, in turn, vouches for).

Here's how a CA does its job. When a website operator wants a certificate, they generate a key pair and send the CA a request containing their public key and the domain they claim. The CA verifies that the requester actually controls that domain — for example, by asking them to place a specific file on the site or a specific record in DNS (this is domain validation). Once satisfied, the CA creates a certificate binding the public key to the domain and signs it with the CA's own private key. Anyone can now verify that signature using the CA's widely-distributed public key, and so trust the binding — chains of CAs (a root CA vouching for intermediate CAs) extend this trust without exposing the precious root key.

Why it matters: CAs are the anchor of trust that makes HTTPS work at Internet scale — you can trust millions of sites you've never visited because you trust a few hundred CAs. But that's also the weak point. A CA is a single point of trust: if a CA is compromised or tricked into issuing a fraudulent certificate, an attacker can impersonate any site. This has happened. Defenses like Certificate Transparency (public logs of every certificate issued) and certificate revocation exist precisely because the trust we place in CAs is powerful and therefore dangerous if abused.