A certificate authority issues digital certificates that bind a public key to an identity. When you visit a website over HTTPS, your browser checks the site's certificate against a list of trusted CAs. If a trusted CA signed it and the domain matches, the browser shows a padlock. If not, you get a warning. The CA is the trust anchor. Break it and the whole system fails.

CAs verify identity before issuing. Domain validation confirms control of a domain. Organization validation checks the company exists. Extended validation adds a more thorough review, though browsers have reduced its visual prominence. The verification is not perfect. DigiNotar was compromised in 2011 and issued fraudulent certificates for Google domains. The company went bankrupt. Symantec misissued certificates for years before browsers distrusted it. The system survived because multiple CAs exist and browsers can revoke trust. Certificate transparency logs now record every issued certificate publicly, so misissuance gets caught faster. The trust model is centralized and fragile, but it has held up better than most alternatives.

Certificate validation levels

• Domain validation — proves control of the domain
• Organization validation — confirms the company exists
• Extended validation — thorough identity check
• Certificate transparency — public logs of issued certificates

When a browser warns about a certificate, pay attention. It usually means something is wrong.