Cryptography › Module 3 › Lesson 3
Certificate Authorities
How CAs vouch for sites—and what happens when trust is broken
Opening
Someone has to vouch
Your device ships with a list of trusted root CAs. When a CA signs a certificate for shop.example, browsers treat that signature as evidence—if the chain validates and policies are met. That power is why CA breaches and rogue issuances are big news.
1. What CAs Do
Validate control
Domain Validation (DV) checks you control the domain; OV/EV add organization checks (UI differences shrunk over time).
Issue & sign
Produce certificates browsers will accept for matching names.
Revoke when needed
Respond to key compromise or mis-issuance.
2. When Trust Breaks
History includes mis-issued certificates and CA distrust events. Browsers can distrust roots. Certificate Transparency logs help the public notice unexpected issuance for a domain. As a defender: monitor your domains’ CT entries, automate renewal before expiry, and never click through unknown CA warnings on sensitive sites.
Let’s Encrypt is still a real CA
Free automated CAs are legitimate when chains validate. “Free” ≠ “fake.” Fake is a name mismatch or untrusted issuer.
Knowledge Check
A Certificate Authority’s job is to:
Multiple choice
Knowledge Check
True or False: Operating systems and browsers ship with trusted root CA stores.
True or False
Knowledge Check
Certificate Transparency helps the public:
Multiple choice