What is a Certificate Authority (CA) and how does it establish trust?

A Certificate Authority is the entity that verifies identities and signs digital certificates to vouch for the binding between a public key and its owner, forming the anchor point that every other trust decision in a PKI ultimately depends on.

How trust flows from a CA:

• Root trust: Relying parties are configured to trust the CA's root certificate as a starting point.
• Chain of trust: That trust extends to every certificate the CA, or its subordinate CAs, signs.
• Conditional trust: Trust holds only as long as a certificate has not been revoked and remains within its validity period.
• Verification, not assumption: Relying parties actively check these conditions rather than assuming a certificate is trustworthy simply because it exists.

This chain-of-trust model is what allows a single CA to vouch for potentially millions of certificates without each one needing to be individually verified by every relying party from scratch.