What is a Certificate Authority (CA) and why is it needed?
A CA is a trusted third party that issues digital certificates binding a public key to an identity — solving the "how do I know this public key really belongs to Bob?" problem.
* The CA signs a certificate binding Bob's identity to his key; anyone verifies it with the CA's key. *
The problem: In asymmetric crypto, Alice needs Bob's public key. But how does she know the key she received is actually Bob's? Eve could have substituted her own public key (man-in-the-middle attack).
The solution — Certificates:
- Bob brings his public key and proof of identity to the CA
- The CA verifies Bob's identity
- The CA creates a certificate containing Bob's name + public key, signed with the CA's private key
- Anyone can verify the certificate using the CA's public key
A certificate essentially says: "I, the CA, certify that this public key belongs to Bob."
Trust model: You only need to trust the CA (and have its public key) to verify anyone's certificate. This is how HTTPS works — your browser comes pre-loaded with trusted CA root certificates.
Go deeper:
Certificate authority — how PKI trust roots work.