Certificate Authority: CA, RA and Signing Requests

Certificate authority and registration authority

An issuer of public-key certificates, with registration and certificate-request roles distinguished from issuance.

Published on

2026-11-06

Last updated on

A CA issues and signs certificates under a defined policy.
An RA can check enrollment information without being the issuing CA.
A CSR contains a public key and signed request information, not the private key.

What is a certificate authority?

A certificate authority (CA) issues and signs certificates that associate public keys with identified subjects under defined policies. For document signing, the certificate helps a relying party assess whose signing key is involved; it is not itself a signature on the agreement.

RFC 5280’s PKI model distinguishes certificate issuers from other participants. The CA’s signature on a signing certificate needs to be evaluated within an appropriate trust framework.

CA versus registration authority

A registration authority (RA) can perform delegated enrollment or verification functions for a CA. It may check or approve a certificate application without being the issuer that signs the certificate. One organization can perform both roles, but the functions remain different.

The checks depend on the certificate type and policy. A certificate issued for one purpose should not be assumed suitable for every signing use, and an identified employee is not automatically authorized to bind their company.

What is a certificate signing request?

A certificate signing request (CSR) asks for issuance of a certificate. PKCS #10, specified in RFC 2986, includes a subject, public key and possible attributes, with the request signed using the corresponding private key.

The private key is not included in the CSR. The request’s signature supports proof of control of that key; it does not make every requested identity attribute true or automatically cause a CA to issue a certificate.

What happens after issuance?

The resulting certificate participates in a chain of trust and has a validity period and status. Expiry and revocation must be considered when relying on it. Issuance is one part of the lifecycle, rather than a guarantee that every later use is valid.

A Common Case: Reviewing an issuer’s role

A Texas insurance agency evaluating certificate-based signing might ask who issues the signing certificates and who performs enrollment checks. Distinguishing CA and RA responsibilities would help explain the process without assuming that the certificate also grants authority to sign for a company.

FAQs

Is a registration authority the same as a certificate authority?

No. An RA can perform delegated registration checks, while the CA issues and signs the certificate. One organization may perform both functions.

Does a CSR contain the private signing key?

No. A PKCS #10 request contains the public key and request information, signed with the corresponding private key; it does not include that private key.

Jump to section