Certificate authorities: history and registration

Question

CA's are a key part of the internet's infrastructure few people are aware of. SSL was mostly hacked together at Netscape in 1995. I'd like to understand more about the organizational structure of CA's and the history. How did the current CA's come into existence? What organization decides who can become a CA?

According to wikipedia these are some notable CA's. As far as I know there are several hundreds altogether.

Symantec 38.1% market share
Comodo Group  29.1%
Go Daddy  13.4%
GlobalSign  10%

See also this map of CA's: https://www.eff.org/files/colour_map_of_CAs.pdf

Answer 1

When you refer to CAs you are really talking about CAs that issue public SSL certificates.

There is no overarching organisation responsible for managing the issuance of SSL certificates. It is left to application developers to decide who they trust, and how high to set that bar. The list of trusted Root Certificates in IE and Firefox have considerable differences.

At the end of the 90's I worked for First Data Corporation, who spent considerable time and effort to get themselves added to the Internet Explorer trusted CAs, although to my knowledge they never issued certificates to third parties. It cost many hundreds of thousands of dollars to go through the formal certification process and required that they had a suite of formal PKI policy documents (covering the life cycle of certificates).

This policy was covered by RFC 2527 (later replaced by RFC 3647) although I don't recall whether Microsoft required compliance with that RFC at the time.

More generally there are many CAs that issue certificates for other purposes. I know Skype used to be one of the largest PKI providers - PKI was used to identify users, although I am not sure if this still the case. Quite a few national identity cards in Europe include PKI digital certificates which are used to enable access C2G and B2G via smartcard readers.

Answer 2

Any person can choose to be a CA. At Pediatric Heart Center, we decided to be our own CA, so we maintain a root certificate and private key, and for every certificate that we sign, we update a database with the serial number of the new certificate and other vital details about the certificate that was signed. We then are able to provide these certificates to employees for secure communications, and because all our systems recognize and trust the self-signed root, all the child certificates that we create are automatically accepted by our employees' systems.

Where the network of trust becomes a little bit more hairy is for those members of the general public who must choose to recognize our root certificate and then decide how much trust to provide to it. For our customers, we are able to give them a little education on what they can expect and how to proceed with providing "Trust" to our root certificate on their various systems.

Each Web Browser comes with a set of root certificates already installed and "pre-trusted". These Certificate Authorities have been well established and are no longer questioned by the public at large.

If you are looking to be among these root certificates, which are pre-installed and pre-trusted, your best bet is to contact the browser manufacturers, and if possible have your credentials and root CA certificate authorized by a central internet standards board.

Mr. Deters suggested that ICANN was a good place to start with his somewhat sarcastic comment on your original post. This might actually be a good place to start. Be ready to provide documentation about your signing practices and be open to random inspection, because these are both required of all Certificate Authorities, even private Certificate Authorities like ours at PHC.