The issuer field identifies the certificate authority (CA) or other entity that created an X.509 certificate. It matters because a certificate is trustworthy only when its issuer is trusted and the certificate’s signature can be validated. section 8.1.5 section 8.4
A certificate issuer in practice
A GitHub certificate can show `Issuer: C=US, O=DigiCert Inc, CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1`. This identifies DigiCert as the issuing organization and names the specific CA that created the certificate. The issuer is one of the first breadcrumbs used when following a certificate’s chain of trust. section 8.1.5
openssl x509 -in github-cert.pem -noout -text
Inspect a PEM-encoded certificate with OpenSSL, then locate the issuer among its human-readable fields. section 8.1.3
Read the issuer value as a structured distinguished name:
- `C` identifies the country where the CA is located. section 8.1.5
- `O` identifies the organization that owns the CA. section 8.1.5
- `CN` identifies the CA’s common name. section 8.1.5
- Compare the issuer with the Subject and Validity fields: Subject identifies the certificate’s owner, while Validity defines its active time range. section 8.1.3
A trusted issuer does not by itself complete validation. Verification follows the certificate chain from the end-entity certificate through intermediate CAs to a trusted root CA, while checking signatures and validity dates. In a self-signed root certificate, the issuer and subject are the same because the certificate signs itself. section 8.4 section 9.2.1
