Certificate Authority

Problem

Anyone can create a certificate saying: I am bank.com So receiving a certificate alone proves very little. Why should your browser trust the claim?

A trusted CA verifies control/identity according to its procedures and signs certificates. Your browser can verify that signature.

Trusted CA
    ↓ signs
bank.com certificate

Core idea: a CA acts as a trusted issuer for certificate bindings.