A certificate authority (CA) is an organization or service that signs X.509 certificates, binding a public key to an identity. Clients decide whether to trust that identity by checking the certificate, its issuer, and the CA’s place in a trusted chain. section 8.1.5 section 8.4
A local or private CA operates inside an organization’s or development environment’s trust boundary. Install its CA certificate in the operating system’s trust store, then certificates it issues can validate on those systems without relying on a public CA. section 9.2.2 section 9.4
A CA participates in a certificate life cycle:
- Generate a key pair, keeping the private key secret and sharing the public key through a certificate signing request (CSR). section 9.1 section 9.3
- Validate the requester’s identity or domain control before issuing a certificate. section 9.1 section 9.4
- Sign the certificate with the CA’s private key so clients can verify its authenticity and follow the chain to a trusted root. section 9.1.4 section 8.2.1
- Revoke certificates when a private key is compromised or a certificate should no longer be trusted. section 9.1 section 8.2
Internal HTTPS without disabling validation
A checkout microservice calls an inventory microservice over HTTPS inside one company. Instead of using a self-signed certificate or disabling validation with curl or kubectl, create a private CA, install its CA certificate in the relevant systems’ trust stores, and issue service certificates from it. The services can then test real HTTPS behavior while preserving the trust checks used in production. section 9.1.4 section 9.3
A self-signed certificate is not the same as a private CA: its subject and issuer are identical, and it is not part of a trust chain. Systems and browsers usually warn about or reject it unless separately configured. A private CA provides a reusable trust anchor for certificates within a controlled environment, but its trust must be installed deliberately and kept within that boundary. section 9.1.4 section 9.2.2
Figure 9.1 The certificate life cycle. This figure walks you through the four main steps of getting a valid digital certificate: generating a key pair, creating a CSR, having it validated by a CA, and receiving the issued certificate.
Follow the certificate life cycle from key-pair generation and CSR creation through CA validation and certificate issuance. section 9.1
