A Certification AuthorityFootnote 1 (CA) in a Public-Key Infrastructure (PKI) is an authority that is trusted by some segment of a population of entities—or perhaps by the entire population—to validly perform the task of binding public key pairs to identities. The CA certifies a key pair/identity binding by digitally signing (see digital signature scheme) a data structure that contains some representation of the identity of an entity (see identification) and the entity's corresponding public key. This data structure is called a “public-key certificate” (or simply a certificate, when this terminology will not be confused with other types of certificates, such as attribute certificates).
Although the primary and definitional duty of a CA is to certify key pair/identity bindings, it may also perform some other functions, depending upon the policies and procedures of the PKI in which it operates. For example, the CA may generate key pairs for entities upon request; it may store the key...