Every trusted connection between websites, applications, APIs, and devices starts with a digital certificate. The entity that issues these certificates and vouches for identity is a Certificate Authority (CA). Encrypting communications alone is not enough for organizations to operate secure services. Users must be able to verify that the party they are connecting to is genuine. A certificate authority is the organization responsible for this identity verification and certificate issuance, and it is the foundation that makes trust possible on today's internet.
This article explains what a certificate authority is, why it is needed, what types of certificates it issues, and what organizations need to prepare for as certificate lifespans shorten.
☑️ The Basics of Certificate Authorities (CAs) and Digital Certificates
What Is a Certificate Authority (CA)?
A certificate authority (CA) is a trusted organization that verifies identities and issues digital certificates to protect websites, software, email, and connected devices. For a website to establish an encrypted, trusted connection, it first needs a TLS/SSL certificate issued by a trusted CA.
A certificate authority answers a fundamental security question: "Can I really trust the party I am connecting to right now?" It builds trust in the online environment through two processes: identity verification and certificate issuance.
Why Are Certificate Authorities Needed?
The internet relies on encryption to protect sensitive information from threats. However, encryption alone is not enough. Users need a way to trust the identity of the websites, applications, and organizations they interact with. By verifying identities and issuing trusted certificates, certificate authorities help establish secure connections between browsers, web servers, applications, and devices. This process is what protects sensitive data such as passwords, payment information, and personal information in transit.
Without certificate authorities, the digital services that countless people use every day, such as online shopping, banking, and healthcare portals, would be far more dangerous.
That said, having a certificate does not automatically make a website trustworthy. Attackers can also obtain domain validation (DV) certificates for malicious sites. This is why organizations that handle sensitive transactions choose organization validation (OV) or extended validation (EV) certificates, which require additional verification.
How Do Certificate Authorities Support Internet Security?
If you have ever seen a "Not Secure" warning in your browser, it is likely that the site does not have a valid TLS/SSL certificate or that its certificate has expired. For a website to display a secure HTTPS connection, it must first obtain a trusted certificate from a publicly trusted certificate authority.
Before issuing a certificate, the certificate authority verifies that the requester is authorized to receive it. This verification process establishes trust in the certificate and in the identity or resource that the certificate represents.
Types of TLS Certificates
TLS certificates can be classified by two criteria. One is the level of validation the certificate authority provides, and the other is the scope of what the certificate protects. The validation level indicates how thoroughly the CA verifies the certificate holder's identity before issuing the certificate, and the deployment type indicates how many domains or subdomains the certificate protects.
The validation level depends on the type of certificate requested. Moving from DV to OV to EV, validation requirements increase, and so does the level of identity assurance provided. All three certificate types provide encryption, but they differ in the amount of information verified before issuance. Domain validation (DV) only confirms control over the domain, while organization validation (OV) and extended validation (EV) involve additional identity verification.
By deployment type, a single-domain certificate protects one website domain, a wildcard certificate protects a domain along with its subdomains, and a multi-domain (SAN) certificate protects multiple domains with a single certificate.
Other Digital Certificates Issued by CAs
TLS/SSL certificates are the most widely known digital certificates, but they are not the only certificates certificate authorities issue. Today, certificate authorities help establish trust not only for websites but across software, email, documents, and connected devices. A variety of certificates, including code signing, document signing, and email security (S/MIME), are used to protect interactions in the modern digital environment.
How Are Certificates Issued?
The first step in obtaining a certificate from a CA is generating a Certificate Signing Request (CSR). A CSR contains information about the website domain, organization, or system requesting the certificate. Submitting this CSR to the issuing CA begins the application process.
The certificate authority then performs the validation required for the requested certificate type. DV certificates require proof of domain control, while OV and EV certificates require additional identity verification. Once validation is complete, the CA issues the certificate, which can then be installed on the relevant web server, application, device, or service.
☑️ Why Certificate Management Becomes an Operational Challenge
Why Can Certificate Authorities Lose Trust?
Trust is the foundation of a certificate authority's role. However, that trust is not guaranteed forever. To become a trusted certificate authority, an organization must meet strict industry requirements, undergo regular independent audits, and comply with standards set by bodies such as the CA/Browser Forum. Browser and operating system vendors also operate trust stores that determine which certificate authorities are recognized on users' devices. If a CA fails to meet these requirements or experiences serious security or operational issues, browsers and operating systems may distrust that CA's certificates.
There is a real-world example. In 2024, Google, Mozilla, and Apple announced that they would distrust certificates issued from Entrust roots, citing ongoing compliance and security concerns. Affected Entrust customers had to migrate to other trusted certificate authorities to avoid browser warnings and potential service disruptions. This incident shows that trust is not something earned once but something that must be maintained continuously. This is why, when choosing a certificate authority, organizations should evaluate not only price and certificate types but also reputation, security practices, audit history, and long-term stability.
Growing Operational Challenges as Certificate Lifespans Shorten
Obtaining a certificate is only the beginning. Today, certificates are deployed across websites, applications, cloud environments, APIs, software supply chains, machine identities, and connected devices. Managing these certificates with visibility, keeping them up to date, and deploying them correctly has become a major operational challenge in itself.
This challenge is growing as certificate validity periods are shortened in phases. The CA/Browser Forum voted to amend the TLS Baseline Requirements to shorten certificate lifespans and validation data reuse periods, with the first impact beginning in March 2026. The maximum lifespan of publicly trusted TLS certificates is reduced to 200 days from March 15, 2026, 100 days from March 15, 2027, and 47 days from March 15, 2029.
Along with shorter lifespans, validation data reuse periods are also being shortened. From March 15, 2029, while the maximum certificate lifespan is 47 days, the period during which domain validation data can be reused is only 10 days. At that point, manual revalidation, while technically possible, becomes an approach prone to causing outages.
These changes turn what used to be occasional renewal work into a continuous operation of renewal, validation, and deployment. Because web servers, APIs, applications, and internal services all depend on certificates, missing even a single renewal can have an impact that spreads across critical systems. This is why many security teams are investing in Certificate Lifecycle Management (CLM).
☑️ Certificate Lifecycle Management and Adoption Approach
Certificate Operations Supported by DigiCert Trust Lifecycle Manager
DigiCert is one of the world's leading certificate authorities, but for many organizations, certificate issuance is only the starting point of operations. DigiCert TLM (Trust Lifecycle Manager) is a certificate lifecycle management solution that helps organizations discover, automate, and govern the certificate lifecycle across cloud, hybrid, and on-premises environments. The capabilities TLM provides can be summarized from the following four perspectives.
First, visibility. TLM imports certificates from any CA or trust store and scans networks, clouds, and endpoints to find even certificates and keys whose locations were previously unknown. Because expiration risk cannot be controlled without knowing where and how many certificates are deployed, understanding all certificates in one place is the starting point of operations.
Second, governance. TLM defines standards for algorithms, key sizes, and certificate lifespans, applies policies by region, environment, and business unit, and enables each team to manage certificates securely through role-based access. As organizations grow and environments become more distributed, maintaining a consistent cryptographic policy becomes more difficult, and applying policies centrally reduces the problem of fragmented certificate management standards.
Third, control. TLM catches expirations and misconfigurations before they affect service availability and delivers advance alerts about upcoming expirations and policy violations to the appropriate owners and systems. As certificate lifespans shorten, the likelihood of missing an expiration increases, so advance alerts and connecting to the right owners play a direct role in preventing service outages.
Fourth, automation. TLM handles renewals and repetitive changes on the platform, integrates with CA, ITSM, cloud, application delivery, and IAM tools, and connects to existing workflows through APIs and standard protocols. In a 47-day certificate environment, it is difficult to keep up with renewal cycles through manual processes, making policy-based automation a practical way to reduce the operational burden.
In the Total Economic Impact study commissioned by DigiCert and conducted by Forrester Consulting (based on a hypothetical composite organization built from interviews), results such as a 96% reduction in certificate-related outages and a 312% ROI were presented as the effects of adopting TLM.
☑️ Frequently Asked Questions
What is a certificate authority (CA)?
A certificate authority (CA) is a trusted organization that verifies identities and issues digital certificates to protect websites, software, email, and devices. For a website to establish an HTTPS encrypted connection, it needs a TLS/SSL certificate issued by a trusted CA.
How do DV, OV, and EV certificates differ?
All three provide encryption, but they differ in the amount of information verified before issuance. DV only confirms control over the domain, while OV and EV involve additional identity verification. The level of identity assurance increases from DV to OV to EV.
Can certificate authorities lose trust?
Yes. If a CA fails to meet industry requirements or audit standards, or experiences serious security or operational issues, browsers and operating systems may distrust that CA's certificates. A representative example is the 2024 announcement by Google, Mozilla, and Apple that they would distrust Entrust root certificates, after which affected customers had to migrate to other CAs.
Why are certificate validity periods getting shorter?
Because the CA/Browser Forum voted to shorten certificate lifespans and validation data reuse periods in phases. The maximum lifespan is reduced to 200 days from March 15, 2026, 100 days from March 15, 2027, and 47 days from March 15, 2029. The change is intended to revalidate the trustworthiness of the information contained in certificates more frequently.
Why is certificate lifecycle management (CLM) necessary?
As certificate lifespans shorten, renewal, validation, and deployment become continuous tasks, and manual management increases the risk of missed expirations and service outages. CLM reduces these operational risks by automating certificate discovery, renewal, deployment, monitoring, and policy enforcement.
☑️ Conclusion
Certificate authorities are the foundation that makes trust possible in the digital environment, and certificates are the means by which that trust is put into practice. However, as certificate lifespans shorten and deployment environments become more complex, lifecycle management after issuance is becoming a core challenge for security teams. Gaining certificate visibility, maintaining policy consistency, and automating renewals are operational requirements that can no longer be put off.
Based on DigiCert TLM (Trust Lifecycle Manager), CloudNetworks supports customers from gaining certificate visibility to establishing policies, automating renewals, and building operational frameworks tailored to their environments. If you need a review of your current certificate operations or are considering adoption, please contact us through the link below.
▶ DigiCert TLM Learn More
[Source : DigiCert, "What's a certificate authority? A beginner's guide to CAs", DigiCert, "TLS Certificate Lifetimes Will Officially Reduce to 47 Days", DigiCert, "47-Day TLS/SSL Certificates", DigiCert, "Trust Lifecycle Manager"]
