A certificate authority (CA) is an organization that verifies who controls a domain and then signs a TLS certificate vouching for it. Browsers and operating systems ship with a list of trusted root CAs; a certificate is trusted if it chains back to one of them.
Why it matters
The CA is the reason a browser believes the server it reached is really example.com. If the CA is distrusted, the chain is broken or the certificate is revoked or expired, visitors see a full-page warning and most will leave.
Example
A typical chain has three links:
Leaf: www.example.com (issued to you, short-lived)
Intermediate: Example CA R1 (signs leaf certificates)
Root: Example Root CA (in the browser trust store)Your server must send the leaf and the intermediate. The root is already in the client. Public certificates are issued under the CA/Browser Forum Baseline Requirements, which also cap validity periods and have been shortening them; Let's Encrypt, for instance, issues 90-day certificates. Check your CA's current limits.
Common mistakes
- Serving only the leaf certificate, which breaks validation on clients that do not fetch missing intermediates.
- Assuming a certificate is valid everywhere because it works in your browser, which may cache intermediates.
- Ignoring CAA records, which let you restrict which CAs may issue for your domain.
- Paying for a certificate type you do not need: domain validation is enough for most sites.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.