A certificate authority (CA) is an organisation that issues digital certificates, after checking that the person or company asking for one really controls the website name or the identity in it. The CA's digital signature on a certificate is what makes browsers believe the certificate. A digital certificate is a small file that links a website name, or a person, to a cryptographic key.
How does a browser decide to trust a CA? The makers of browsers and operating systems keep a list of trusted root certificates, called a root store. A CA earns a place in the root store by passing yearly audits and following rules that browser makers and CAs agree together. The CA keeps its root certificate offline. It signs customers' certificates with an intermediate certificate, which the root has signed. When your browser receives a website's certificate, it checks each signature up this chain until it reaches a root in its store. This is called the chain of trust, and it is the core of public key infrastructure (PKI).
Say a family business in Guntur that sells pickles online sets up a new website. Its web hosting provider asks a CA for a certificate for the shop's domain. The CA sends back a random code and asks for it to be placed in a DNS record of that domain. The hosting provider adds the record through the shop's domain registration and DNS provider. A minute later, the CA looks up the record and finds the code. This proves that whoever asked for the certificate controls the domain. The CA signs a certificate that is valid for 90 days and sends it back. A customer who opens the shop's site now sees no security warning, because her browser follows the signatures back to a root that it trusts. Before the 90 days end, the hosting provider repeats the same steps. Large companies run these renewals through certificate lifecycle management.
This check proves only that the requester controls the domain, so it is called domain validation. For organisation validation, the CA also checks the company's registration documents.
India has a second kind of certificate authority. Under the Information Technology Act, 2000, the Controller of Certifying Authorities (CCA) licenses certifying authorities that issue digital signature certificates (DSC) to people. Indians use these to sign income tax returns, company filings and government tenders. Both kinds use the same technology, but a website certificate proves a website, and a DSC proves a person.
A company can also run its own private CA, which issues certificates only for its own laptops, servers and staff badges. Some companies use the same credential to open the office door and to log in, through physical access control.