What are certificates?

Certificates are essentially attestations of truth—in other words, a certificate is a document that says, trust me, this is true. This sounds simple, and in some ways it is. But in other ways, the various uses of certificates and deploying a CA infrastructure securely is a significant challenge—for instance, we've seen some spectacular failings in public CAs in recent years: companies whose only business was securing the certificate process couldn't get it right when under scrutiny. We cover the challenges and solutions in securing CAs in more detail later in this chapter, in the Securing your CA infrastructure and CT sections.

At the root of things, workstations and servers have a list of CAs that they trust. This trust is delivered using cryptographically signed documents that are the public certificates of each of those CAs, which are stored in a specific place on a Linux or Windows host.

When you browse to a web server, for instance...