What is the purpose of SSL Certificate Authority (CA)?

Question

What is the purpose of an SSL Certificate Authority? How would a CA prevent dishonestcompany.com from doing something dishonest? What does the CA signing of the SSL/TLS cert for dishonestcompany.com really represent?

Answer 1

What OP are asking, is "What prevents dishonestcompany.com from buying a SSL certificate for dishonestcompany.com and then running a fake webshop from there, collecting card details."

The thing is that this is not something SSL certificates are designed to prevent. SSL certificates are designed to prevent someone impersonating another site.

Certificates also provide a ID card for the website in question, so if the organization in question have purchased a higher grade certificate, or even a EV certificate, the owner of the website can be identified, and prosecuted in case of any fraud.

You can see certificates like a ID card in real life. As with all ID cards, you cannot just accept everyone having a ID card, then you lack a "authorization" step. This is same with for example signed software. What you need to do, is to verify, that the verified identity is the identity you wish to talk to.

You can see this as: Real Identity -- Claimed Identitiy -- Wanted Identity.

A CA provides a link between Real Identity and Claimed Identity. But for everything to work, you also need to make sure to verify the Claimed Identity matches the Wanted Identity. Eg, if you go to "dishonestcompany.com" to do your internet banking when you intented to go to "internetbank.com", then SSL certificates will not prevent you from felling into the trap.

Without CA's however, theres no link between Real Identity and Claimed identity, so even if you verify that Claimed Identity is identical to Wanted Identity, you can fall in the trap if you are victim of a MITM attack.

The browser verifies that the certificate matches the hostname you typed in, but YOU as a human, need to verify that the typed hostname is really the one you intended to visit!

In laymans terms, lets say you are Barack Obama, and want to let in Joe Biden into the white house.

What CA's in this case is, the one who issues me a ID card with the name "Sebastian Nielsen" on it. BUT: Lets say I show my ID card "Sebastian Nielsen" to you, and you let me in because I own a ID card. The ID card is no indication that im thrustworthy or wont do any harm. Its just a identity card. What you need to verify, is that the name on the ID card matches the name you want to talk to. This is called "authorization", eg checking that the identity is authorized to access the White House. Eg, you need to check that the name is on the list of authorized visitors, eg that the name on ID card in this case is Joe Biden.

Answer 2

The "purpose of an SSL Certificate Authority" is hopefully helping to implement Public Key Infrastructure.

A CA would do its part of preventing "dishonestcompany.com from doing something dishonest" by not giving dishonestcompany a certificate for any site which dishonestcompany doesn't own.

The "CA signing of the SSL/TLS cert for dishonestcompany.com really" represents that the CA believes someone authorized by dishonestcompany claims to have generated the included public key for SSL/TLS.