What Is Certificate Authority?

A certificate authority issues digital certificates binding a public key to an identity, and its signature is what makes the binding trustworthy. The entire public key infrastructure rests on relying parties trusting a set of authorities to verify identity properly before signing.

Public and private authorities differ in purpose

Public authorities issue certificates trusted by browsers and operating systems through root programmes with audit and compliance requirements. They are what secures public websites, and their issuance is publicly logged.

Private authorities are operated internally for internal purposes — service-to-service authentication, device identity, VPN and wireless credentials. Nothing outside the organisation trusts them, which is precisely what makes them suitable: you control issuance entirely.

Running a private authority is a real operational commitment. Key protection, issuance policy, revocation and renewal all become your responsibility, and the consequences of neglect arrive as outages.

The root key is the crown jewel

Whoever holds the private key of a trusted root can issue certificates for any identity that root covers. For a private authority that means impersonating any internal service; for a public one it would mean impersonating anything on the internet.

Which is why roots are held offline, in hardware, with ceremonial procedures for use, and why day-to-day issuance is performed by intermediate authorities whose compromise can be contained by revoking the intermediate rather than the root.

Running a private authority is an operational commitment

Organisations stand one up for internal service authentication or device certificates and frequently underestimate the ongoing work. Issuance policy, key protection, revocation handling, intermediate renewal and root expiry all become permanent responsibilities.

Root expiry is the one that produces the most memorable outages. A root issued with a twenty-year life by someone who has since left will eventually expire, and everything trusting it will fail simultaneously. The date is knowable today and is almost never recorded anywhere anyone will look.

Managed private authority services now remove much of this burden, and for most organisations they are the better answer than operating the infrastructure directly.

Constraining what an authority may issue

A trusted authority can, by default, issue a certificate for any name. Name constraints limit an intermediate to specific domains, so a compromise of an internal authority cannot produce a certificate for an external service your systems also trust.

This matters particularly where an internal root is distributed to endpoints. Without constraints, that root can vouch for anything — including public sites — which turns a compromise of internal PKI into a capability for intercepting external traffic.

Constraints are configured at issuance and cannot be retrofitted, which is a reason to think about them before the intermediate is created rather than afterwards.

The thing most worth getting right

Where to start

Establish whether you operate a private authority, who holds its keys, and when its root expires. Internal authorities set up years ago by someone who has since left are common, and their expiry is an outage waiting on a date nobody has noted.

See digital certificates and TLS. GuardsArm runs security program reviews.