Understanding the different types of certificate authorities 

Establishing trust online is a crucial component of collaboration in the digital age. From using a third-party vendor to shopping online to communicating via email, companies and individuals rely on this trust to do business. How can they know they are communicating with the right person and not an actor behind a phishing scheme?

A certificate authority (CA) plays a vital role in making this happen. CAs follow strict industry standards, verify identities, and issue digital certificates. Here is your guide to what a CA is, why it matters, and the different types of CAs available today.

What is a Certificate Authority (CA)?

Certificates ensure a system is who they say they are, but the system must also be assured that the certificate itself is genuine. This is where trusted third parties come into play. Certificate authorities are independent bodies that issue and vouch for certificates.

As a vital component of the public key infrastructure (PKI), CAs create digital certificates that cryptographically link public keys with the owners’ identities. The CA is responsible for validating the identity of the entity associated with a given public key and issuing the digital certificates that attest to this identity. The CA follows specific protocols to verify the requester's identity before issuing the certificate. This protocol involves checking official documentation or performing a background check.

CAs also have mechanisms for revoking certificates. Revocation happens when a key associated with a certificate is compromised or if the entity that was issued a certificate no longer exists.

Importance of Certificate Authorities

CAs play a crucial role in ensuring internet security. Certificates can secure digital signatures and establish secure network connections via protocols such as HTTPS. 

Here are some of the top reasons why CAs are critical in the digital world:

• Establishing trust: CAs provide the foundation of trust on the internet. For example, when users connect to a website, their browser trusts the website if it has a valid certificate issued by a trusted CA. Without this mechanism, it’s hard to establish trust between two parties that have never interacted.

• Verifying identity: Certificate issuance requires verifying the requester’s identity. This ensures that the entity requesting a certificate is who it claims to be.
• Preventing data theft: Secure connections established using certificates help prevent unauthorized data access. When data is sent over a secure connection, encryption makes it unreadable even if bad actors successfully intercept it.
• Protecting against scams: CAs help protect users against phishing attacks and other scams. When users navigate websites, they can be confident the site is legitimate and is not a malicious imitation built to steal personal information if it has a valid certificate.
• Revoking certificates: If a certificate is issued incorrectly or the private key is compromised, the CA can revoke the certificate and prevent further use.

The different types of Certificate Authorities

Each type of CA and the certificates they issue offer pros and cons. Organizations need to consider which is best depending on their goals, industry regulations, and the level of trust required. 

Below, we separated the types of CAs based on function, authority, products, and hierarchy to more clearly explain the advantages and drawbacks of each type of certificate.

Types by function

• Domain validated (DV) CAs: DV certificates are simpler and require less rigorous checking. DV CAs issue certificates after validating only the ownership or control over the domain for the requested certificate. DV certificates are usually cheaper and easier to obtain but provide lower trust because they don’t include the identity of the organization that owns the domain.
• Organization validated (OV) CAs: OV CAs go a step beyond DV CAs by verifying organizational details such as name, legal existence, and physical location in addition to domain ownership. OV certificates offer a higher level of trust than DV certificates because they associate the domain with a specific organization. However, they are more expensive and take longer to issue.

• Self-signed CAs.: A self-signed certificate is not issued by a recognized CA. Instead, the entity that will be using it generates and signs it, which means there is no external verification of the certificate information. As a result, self-signed certificates are typically not trusted by web browsers or other software, and they generate a warning when users encounter them. While they are useful in testing or internal use cases, they’re not suitable for secure public internet communications.
• Extended validation (EV) CAs: EV certificates require the most stringent verification process. In addition to verifying domain ownership and organizational details, the EV CA verifies the organization's physical and operational existence, the requester’s identity and authority, and the organization’s policy and procedures for requesting an EV certificate. EV certificates have the highest level of trust and are often used by enterprises and financial institutions. While they are the most expensive and time-consuming to obtain, they are valuable for entities that want to establish the highest level of trust with their users.

Types by authority

• Public CAs: Public CAs, also called root CAs, issue digital certificates for public-facing software and servers, which are used for secure communication on the internet. Public CAs are trusted by browser and operating system vendors, and their root certificates are embedded in web browsers and operating systems. They follow stringent protocols and regulations to verify the entity identity, depending on the type of certificate requested.
• Private/internal CAs: Private or internal CAs are used within an organization to issue certificates for internal use. They are typically not trusted outside the organization.

Types by product

• Government CAs: Government agencies usually establish government CAs to issue certificates for government entities and, in some cases, citizens and businesses within a country. They often adhere to strict identity validation procedures and policies mandated by relevant government regulations. One example is the U.S. Federal Public Key Infrastructure (FPKI).
• Commercial CAs: Commercial CAs offer certificate services to the public. They provide a variety of certificate types, including DV, OV, and EV certificates, to secure websites, enable secure email communication, authenticate users, and more. Commercial CAs like Sectigo offer robust customer support, various wildcard and multi-domain certificates, and a longer certificate lifespan.
• Open-source CAs: Open-source CAs provide certificates using open-source software and principles. Often, their basic services are free to use, and their underlying software is open-source, which the public can inspect and contribute to. The most notable example is Let’s Encrypt, a nonprofit CA run by the Internet Security Research Group. However, they only offer DV certificates, which have a lower level of trust and typically have a shorter lifespan.

Hierarchy CAs

• Issuing CAs: The authenticity of issuing CAs isn’t directly recognized by an operating system but is instead validated by an intermediate CA. Any certificate provided by issuing CAs is deemed reliable if the intermediate CA can successfully authenticate it.
• Intermediate CAs: Intermediate CAs sit between the root (or public) CA and the issuing CA in a hierarchical PKI. They are issued a certificate by the root CA, and they can then use that certificate to issue certificates to intermediate CAs or end entities directly.

Establishing trust in the digital world

Certificate authorities play a fundamental role in establishing the security and integrity of digital communications. They help validate identities, issue digital certificates, and build trust among users and entities. CAs also offer different types of certificates to meet organizational needs and circumstances.

If you need a robust, proven certificate authority to secure your website, authenticate users, and facilitate secure email communications, Sectigo can help. As one of the world’s largest commercial CA, Sectigo offers a variety of certificate types to fit your needs, backed by comprehensive customer support. 

Contact Sectigo today and explore our suite of digital certificate solutions.