What is a certificate authority?
A certificate authority is an organisation your browser trusts to vouch that a website really is who it claims to be, by issuing it a digital certificate.
In plain English
When you visit a site and see https:// with a padlock, your browser is checking a digital certificate. That certificate is a signed statement saying “this really is yourbank.com”. The organisations allowed to sign those statements are called certificate authorities, or CAs.
Browsers and operating systems keep a list of CAs they trust, called a root program. If a CA is on the list, every certificate it signs is accepted automatically by billions of devices. That is an enormous amount of trust placed in a handful of companies.
Why it matters now
This week eMudhra, an Indian digital trust company, announced it is withdrawing from the global SSL/TLS certificate business after a security incident involving its certificate authorities. The company said it revoked the affected CAs within 14 hours and that no customer data was breached, but the scrutiny that followed led its board to exit the line of business entirely.
That pattern is normal in this industry. A CA’s only real product is trust, so once browser makers and security researchers start asking hard questions, the business often becomes unviable.
An example
If a CA mistakenly, or maliciously, issued a certificate for your bank’s address to someone else, that person could run a convincing fake site and your browser would show the padlock as usual. This is why browser vendors police CAs closely and remove ones that slip up.
What to watch out for
The padlock only tells you the connection is encrypted and the certificate checks out. It does not tell you the site is honest. Scam sites get valid certificates too, often free ones. Read the address carefully rather than trusting the icon.