View source for Certification Authority

== Governance and Accountability ==
From an Internet Governance perspective, certificate authorities sit in an unusual institutional position: they are private entities that effectively mediate global trust for Web authentication, yet their “regulatory” environment is largely established through private coordination (CA/Browser Forum) and platform gatekeeping (browser/OS trust stores), rather than treaty-based or intergovernmental processes.<ref name="cabf-about">[https://cabforum.org/working-groups/server/baseline-requirements/about/ CA/Browser Forum, "About the Baseline Requirements" (accessed 2025-12-11).]</ref><ref name="mozilla-policy" /><ref name="chrome-root" />

Accountability mechanisms include:
* '''Root program governance''': vendors can impose requirements, demand disclosures, and ultimately remove trust for CA roots or intermediates, which can have global operational impact for websites and services relying on that CA.<ref name="mozilla-policy" /><ref name="chrome-blog-2025">[https://security.googleblog.com/2025/05/sustaining-digital-certificate-security-chrome-root-store-changes.html Google Security Blog, "Sustaining Digital Certificate Security..." 30 May 2025.]</ref>
* '''Audits and compliance reporting''': root programs and the BRs rely heavily on periodic audits and public audit statements as prerequisites for continued inclusion.<ref name="mozilla-audits">[https://wiki.mozilla.org/CA/Audit_Statements MozillaWiki, "CA/Audit Statements" (accessed 2025-12-11).]</ref><ref name="cabf-br" />
* '''Public transparency measures''': Certificate Transparency (CT) is designed to make issuance observable by requiring public logging of certificates, enabling third parties to detect mis-issuance and audit CA behaviour at scale.<ref name="rfc9162">[https://www.rfc-editor.org/rfc/rfc9162.html B. Laurie et al., "Certificate Transparency Version 2.0", RFC 9162, IETF, December 2021.]</ref>