A Certificate Authority (CA) is the trusted entity that issues digital certificates and digitally signs them so browsers, services, and devices can verify an identity. In PKI, the CA sits at the center of trust: if the signature chains back to a trusted CA, the certificate is accepted as valid for a domain, user, service, or device.
In cyber security, CAs matter because they control who can prove trust online. Defenders rely on public and private CAs for TLS, machine identity, and automated renewal systems such as ACME. Attackers also target this trust layer by abusing stolen CA credentials, issuing fraudulent certificates, or exploiting mis-issuance to impersonate legitimate services and hide phishing or man-in-the-middle activity. Strong CA governance, revocation, and certificate inventory are therefore essential, especially as certificate lifetimes shrink and automation increases.