What is a CA (Certificate Authority)?

Short answer

A CA (Certificate Authority) is the organization that vouches for the identity of a certificate's owner by signing certificates with its own private key. Clients (browsers, operating systems) carry the list of the root CAs they trust in their trust stores; if the certificate chain of a certificate reaches one of these roots, the certificate is trusted. In TR7, the Certificate Authorities (CA) screen does two jobs together: the certificate of an external CA is added as a trusted CA (Add a trusted CA certificate), or an internal CA that can sign certificates on the device is set up (Create Root CA, Create Issuing CA, Enroll under an external CA, Import Existing CA).

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → Certificate Authorities (CA) → Add	Operation: Add a trusted CA certificate, Create Root CA, Create Issuing CA, Enroll under an external CA, Import Existing CA	Adding a trusted CA or setting up an internal CA
Certificate Authorities (CA) list	Kind: Trust Anchor, Internal Root CA, Internal Issuing CA, Enrollment Pending, Internal CA	The type of the record
SSL/TLS Certificates → Manual and PFX	Intermediate Cert. Content, Root Cert. Content (Use Profiles)	Building the chain of the certificate from the CA record
Certificates & PKI → TLS Security Profiles	CA Certificate Files	The CAs that will verify the client certificates in mTLS
Backend Service	Verification CA Profile	The CA that will verify the Backend Service certificate
Load Balancer → Profiles (L4-L7 Behavior Sets) → Health Checks	Verification CA Profile	The CA that will verify the server certificate in a health check that uses TLS; if it is left as None, the CA in the Backend Service is used
SSL/TLS Certificates → Internal CA	Issuing CA	The internal CA that will sign the server certificate

Common Misconceptions

• "A CA is only a company that sells certificates." The CAs that organizations run themselves are CAs too; when their root certificates are added to the trust store of the clients, the certificates they sign are trusted.
• "Browsers automatically trust the certificates generated by the internal CA of TR7." Unless the Internal Root CA certificate is distributed to the clients, it is not trusted; for sites open to the internet, a public CA (e.g. Let's Encrypt with ACME) is used.
• "A CA added with Add a trusted CA certificate generates certificates." This record does not carry a private key (Trust Anchor); it is used only in verification and in building the chain (What is a Trust Anchor?).

How it is done in the documentation

• Certificate Authorities (CA) · What Is a Certificate Authority (CA) Record?
• Certificate Authorities (CA) · Record Types
• Certificate Authorities (CA) · Usage Locations

Related questions

• How do I add my own internal CA to TR7?
• Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?
• What is the difference between a root CA and an intermediate CA?
• What is PKI (Public Key Infrastructure)?