CertOneHow does a browser know whether an HTTPS certificate is trustworthy? Certificate authorities validate identities and sign certificates within a public key infrastructure. This article explains their responsibilities, trust mechanisms, and selection criteria.
1. What is a certificate authority?
A certificate authority (CA) is a trusted organization that validates the identity or domain control of a website, person, or organization and issues digital certificates. It is a key component of public key infrastructure (PKI).
1. Core responsibilities
Identity validation:
- Verify certificate applicants
- Apply the validation requirements for DV, OV, or EV certificates
- Confirm control of the requested domains
Certificate issuance:
- Digitally sign certificates with the CA's private key
- Protect certificate integrity and authenticity
- Maintain issuance records
Certificate management:
- Maintain certificate revocation lists (CRLs)
- Provide OCSP status services where supported
- Process revocation requests
Establishing trust:
- Build trust chains anchored in root certificates
- Distribute roots through operating-system and browser trust stores
- Support broad client trust
2. How CA trust works
Root certificates:
- CA root certificates are self-signed
- Trusted roots are included in operating-system and browser trust stores
- They anchor the trust chain
Intermediate CAs:
- Most CAs issue end-entity certificates through intermediate CAs
- This adds security separation
- It simplifies management and revocation
Certificate chains:
- A path from the server certificate to a trusted root CA
- Each issuer's key verifies the signature on the next certificate
- Together they establish the trust path
2. Types of certificate authority
1. Operating model
Commercial CAs:
- Operate commercially
- Offer DV, OV, and EV certificates
- Often include support and warranties
- Charge certificate fees
Nonprofit CAs:
- Aim to expand HTTPS adoption
- Often provide free certificates
- Use streamlined validation workflows
- Let's Encrypt is an example
Enterprise CAs:
- Serve an organization's internal needs
- Issue certificates for internal networks and systems
- Require an organization-managed trust arrangement
2. Validation levels
CAs offering DV certificates:
- Most CAs offer them
- Domain validation is quick and straightforward
- Prices range from free to several hundred RMB in the original comparison
CAs offering OV certificates:
- Verify organization details
- The original comparison lists RMB 1,000–5,000 per year
- Suitable for business identity requirements
CAs offering EV certificates:
- Apply more extensive identity validation
- The original comparison lists RMB 3,000–15,000 per year
- Often chosen by financial institutions and large organizations
3. Certificate providers
1. Let's Encrypt
Features:
- Nonprofit operation with free DV certificates
- Operated by the Internet Security Research Group (ISRG)
- Automated certificate management through ACME
- 90-day certificate validity
Advantages:
- ✅ Free of charge
- ✅ Designed for automation
- ✅ Wildcard certificate support
- ✅ Trusted by major browsers
Suitable for:
- Personal websites and blogs
- Small business websites
- Deployments requiring many certificates
- Projects with limited budgets
Certificate type: DV
2. DigiCert
Features:
- A leading commercial CA
- A substantial market presence
- A range of certificate types
- Enterprise support and services
Advantages:
- ✅ Established brand
- ✅ Enterprise support
- ✅ Certificate warranties, subject to terms
- ✅ Broad trust coverage
Suitable for:
- Large business websites
- Financial institutions
- Deployments requiring warranty coverage
- Organizations needing professional support
Certificate types: DV, OV, and EV
3. Sectigo (formerly Comodo)
Features:
- A major global certificate authority
- Competitive pricing
- A range of certificate types
- Multiple validation methods
Advantages:
- ✅ Competitive prices
- ✅ A broad certificate range
- ✅ Wildcard and multi-domain certificates
- ✅ Broad browser trust
Suitable for:
- Small and medium-sized business websites
- Websites prioritizing value
- E-commerce websites
- Websites of various sizes
Certificate types: DV, OV, and EV
4. GlobalSign
Features:
- A prominent European CA
- Enterprise certificate services
- A focus on security and compliance
- Multiple certificate types
Advantages:
- ✅ Enterprise services
- ✅ Security-focused operations
- ✅ Compliance support
- ✅ Technical support
Suitable for:
- European businesses
- Organizations with compliance requirements
- Large organizations
- Financial institutions
Certificate types: DV, OV, and EV
5. Alibaba Cloud
Features:
- A major Chinese cloud provider
- Free DV certificate options
- Integration with cloud services
- Chinese-language support
Advantages:
- ✅ Free DV options
- ✅ Alibaba Cloud integration
- ✅ Chinese-language interface and support
- ✅ Localized services
Suitable for:
- Websites using Alibaba Cloud services
- Users in China
- Users needing Chinese-language support
Certificate options: free DV and paid OV/EV offerings
6. Tencent Cloud
Features:
- A major Chinese cloud provider
- Free DV certificate options
- Integration with Tencent Cloud services
- Chinese-language support
Advantages:
- ✅ Free DV options
- ✅ Tencent Cloud integration
- ✅ Chinese-language interface and support
- ✅ Localized services
Suitable for:
- Websites using Tencent Cloud
- Users in China
- Users needing Chinese-language support
Certificate options: free DV and paid OV/EV offerings
7. ZeroSSL
Features:
- Free DV certificate options
- ACME support
- 90-day certificate validity
- A user-friendly interface
Advantages:
- ✅ Free DV options
- ✅ ACME automation
- ✅ A user-friendly interface
- ✅ Broad browser trust
Suitable for:
- Personal websites
- Small projects
- Projects needing free certificates
Certificate type: DV
4. Choosing a certificate provider
1. Budget
Limited or no budget:
- Options: Let's Encrypt, ZeroSSL, Alibaba Cloud, Tencent Cloud
- Reason: free DV offerings
Moderate budget:
- Options: Sectigo, GlobalSign
- Reason: pricing and certificate range
Larger budget:
- Options: DigiCert, GlobalSign
- Reason: enterprise services and warranties
2. Certificate type
DV only:
- Options: Let's Encrypt (free), Sectigo (paid)
- Reason: low cost and quick validation
OV required:
- Options: Sectigo, DigiCert, GlobalSign
- Reason: established organization validation and product choices
EV required:
- Options: DigiCert, GlobalSign
- Reason: extensive identity validation
3. Use case
Personal website or blog:
- Option: Let's Encrypt
- Reason: free issuance and automation
Small or medium-sized business:
- Options: Sectigo, Alibaba Cloud, Tencent Cloud
- Reason: pricing and support options
Large business website:
- Options: DigiCert, GlobalSign
- Reason: enterprise services and warranties
Financial institution:
- Options: DigiCert, GlobalSign
- Reason: identity assurance and compliance support
4. Technical requirements
Automated management:
- Option: Let's Encrypt through ACME
- Reason: an automation-focused workflow
Cloud integration:
- Options: Alibaba Cloud, Tencent Cloud
- Reason: integration with cloud products
Multi-domain or wildcard certificates:
- Options: Let's Encrypt, Sectigo, DigiCert
- Reason: support for these certificate types
5. Establishing CA trust
1. Root distribution
Operating-system trust stores:
- Windows: the Windows certificate store
- macOS：Keychain
- Linux：/etc/ssl/certs/
Browser trust stores:
- Chrome: a browser-managed root program, with platform integration depending on the environment
- Firefox: its own trust store, with platform integration options
- Safari: the Apple trust system and macOS Keychain
2. Root inclusion process
Applying for root inclusion:
- The CA applies to operating-system and browser root programs
- It undergoes security audits
- It must meet the program's security requirements
- Approved roots are distributed to clients
Maintaining trust:
- The CA must continue to meet security standards
- It undergoes periodic audits
- It follows applicable industry policies and standards
- Violations can result in distrust
3. Certificate Transparency
CT logs:
- Publicly trusted certificates must meet applicable CT logging requirements
- Logging increases CA transparency
- Helps detect unauthorized certificates
- Browsers enforce their CT policies
6. CA security requirements
1. Technical security
Key management:
- Keep root CA private keys offline
- Use hardware security modules (HSMs)
- Enforce strict access control
- Plan key rotation
System security:
- Apply strong security controls
- Perform regular security audits
- Detect and prevent intrusions
- Maintain disaster recovery plans
2. Operational security
Validation procedures:
- Apply rigorous validation
- Use multiple verification controls
- Prevent identity impersonation
- Record validation activities
Compliance:
- Follow CA/Browser Forum requirements
- Follow applicable industry standards
- Conduct periodic compliance audits
- Respond promptly to security incidents
7. Selection guidance
1. Free certificates
Let's Encrypt：
- Suitable for many common deployments
- Free issuance with extensive automation
- Wildcard support
Cloud-provider free offerings:
- Consider the available free offerings if you use Alibaba Cloud or Tencent Cloud
- Convenient cloud-service integration
2. Paid certificates
Value-focused options:
- Sectigo: competitive pricing and a broad product range
Enterprise options:
- DigiCert: established brand and enterprise support
- GlobalSign: security and compliance services
3. Specialized requirements
Chinese-language support:
- Alibaba Cloud and Tencent Cloud
Extensive identity validation:
- EV certificates from DigiCert or GlobalSign
Automated management:
- Let's Encrypt through ACME
Conclusion
CAs validate identities and issue certificates within the internet's trust infrastructure. Consider budget, validation type, use case, and technical requirements when choosing one.
- Free certificates: Let's Encrypt suits many deployments
- Paid certificates: Sectigo offers value-focused options; DigiCert and GlobalSign address enterprise requirements
- Cloud integration: consider Alibaba Cloud or Tencent Cloud certificate services if you use their platforms
Whichever CA you choose, configure the certificates correctly, renew them on time, and monitor their status. Provider selection is only one part of secure certificate management.