Certification authority

As explained in Real-World Cryptography

A certificate authority is an entity that issues and digitally signs certificates binding public keys to identities or domains.

A certificate authority (CA) is an entity that digitally signs certificates binding public keys to identities or domains. In HTTPS, that signature helps a browser decide whether a server’s public key belongs to the requested website rather than an impostor. section 9.2.1

Trust works through a hierarchy rather than a browser trusting every website directly. Browsers store a relatively small set of trusted root CAs in a trust store; roots may sign intermediate CAs, which sign leaf certificates for domains. section 9.2.1

During the authentication part of a TLS handshake:

• The server sends a certificate chain beginning with its leaf certificate, which contains the website’s public key and domain metadata. section 9.2.1
• Each certificate carries a signature from the certificate above it in the chain. section 9.2.1
• The chain ends at a root certificate already trusted by the browser, allowing trust to extend from the root through intermediates to the website. section 9.2.1

Following a real certificate chain

A browser can display a chain for Google: GlobalSign is the trusted root CA, GTS CA 101 is an intermediate signed by that root, and Google’s *.google.com leaf certificate is signed by the intermediate. section 9.2.1

A CA is powerful but not automatically harmless. A misbehaving CA that signs a certificate for your domain with a key it controls could enable impersonation if it also obtains a man-in-the-middle position. Client-controlled systems can instead use their own PKI or pin a specific certificate. section 9.3

Figure 9.6 The authentication part of a handshake starts with the server sending a certificate chain to the client. The certificate chain starts with the leaf certificate (the certificate containing the website’s public key and additional metadata like the domain name) and ends with a root certificate that is trusted by the browser. Each certificate contains a signature from the certificate above it in the chain.

Trace the TLS certificate chain from the website’s leaf certificate to the browser-trusted root, including the signature linking each certificate. section 9.2.1

How Real-World Cryptography covers it

How deep it goes

Explains trust stores, root and intermediate CAs, leaf certificates, signatures, and impersonation risks without detailing CA operations.

Examples

Uses a Google certificate chain showing GlobalSign, GTS CA 101, and a *.google.com leaf certificate.

What it assumes

Assumes basic public-key and digital-signature concepts while building trust from certificates and browser trust stores.

What you can do after

Evaluate a TLS certificate chain by tracing signatures from a website certificate to a browser-trusted root.

How it connects

Connects certificate authorities with TLS, HTTPS, public-key cryptography, certificate chains, trust stores, web PKI, and man-in-the-middle attacks.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersA local certificate authority is a privately operated certificate authority that issues certificates within an organization's or development environment's trust boundary.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eA certificate authority is a trusted entity that issues or signs digital certificates to attest to the identity of certificate holders.
• 

  liveBookmanning.com
  Learn PowerShell Scripting in a Month of Lunches, Second Edition: Write and organize scripts and toolsA certificate authority is a trusted entity that issues and signs digital certificates after validating certificate requests.
• 

  liveBookmanning.com
  Logs and TelemetryA certificate authority is a trusted entity that issues and validates digital certificates and maintains their revocation records.
• 

  liveBookmanning.com
  Build Python Web Apps with StreamlitA certificate authority is a trusted entity that validates identities and digitally signs certificates for them.
• 

  liveBookmanning.com
  Google Anthos in ActionA certificate authority is a trusted entity that issues and signs digital certificates.
• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityA certificate authority is a trusted entity that issues and verifies digital certificates.

Compare how 8 books explain certification authority →

Related concepts

• certificateproduces · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.
• public-key infrastructureused by · Public-key infrastructure is a framework of authorities, certificates, keys, policies, and procedures for establishing and managing public-key trust and digital identities.
• domain ownershipuses · Domain ownership is the assignment of responsibility for a business domain’s data, including its meaning, structure, quality, documentation, and governance, to the domain that produces it.
• root certificateincludes · A root certificate is a trusted certificate, typically self-signed, that serves as a trust anchor for validating a certificate chain and authorizing subordinate certificates.
• intermediate certificateincludes · An intermediate certificate is a certificate issued by a root or higher-level certificate authority to establish a trust chain for end-entity certificates.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.