A third-party certificate authority (CA) is an organization that issues and signs digital certificates so browsers can verify control of a website’s domain. It is called a third party because it is separate from both the visitor and the website operator. Publicly trusted CAs follow rules and undergo audits to be included in browser and operating-system trust programs.
What the third party is actually checking
A website requesting a normal domain-validated TLS certificate must demonstrate control of the domain. It may do this by responding to a challenge at a specified web address or adding a temporary DNS record. The CA then signs a certificate binding the domain name to a public key. A standard domain-validation certificate does not certify that a store is honest or its products are safe.
How a browser follows the chain of trust
When your browser connects over HTTPS, the server presents its certificate and, typically, supporting intermediate certificates. The browser checks relevant names, signatures, dates and other rules, eventually linking to a trusted root certificate already known to the device or browser.
Why are intermediate certificates used?
A root CA can authorize an intermediate CA that signs website certificates. This helps keep sensitive root-key operations separate from daily issuance. The browser verifies the chain of signatures rather than simply accepting a site’s claim that its certificate is genuine.
What HTTPS protection does not promise
HTTPS encrypts the connection and helps you verify you reached the domain named in the certificate. A scam website can also obtain a legitimate certificate for a domain it controls. Before making a payment or sharing information, inspect the actual domain and the website’s credibility rather than relying on a lock icon alone.
Frequently asked questions
Can a website issue its own certificate?
Yes, but a self-signed certificate generally triggers a browser warning unless that certificate or issuer has been explicitly trusted.
Is Let’s Encrypt a third-party CA?
Yes. Let’s Encrypt offers publicly trusted certificates through automated domain validation.
Related: third-party cookies and what they do.
Leave a Reply