2 cissp ® Official Study Guide Eighth Edition

 Certificate Authorities 
Certifi cate authorities
(CAs) are the glue that binds the public key infrastructure together. 
These neutral organizations offer notarization services for digital certifi cates. To obtain a 
digital certifi cate from a reputable CA, you must prove your identity to the satisfaction of 
the CA. The following list includes some of the major CAs that provide widely accepted 
digital certifi cates: 
■
Symantec 
■
IdenTrust 
■
Amazon Web Services 
■
GlobalSign 
■
Comodo 
■
Certum 
■
GoDaddy 
■
DigiCert 
■
Secom 
■
Entrust 
■
Actalis 
■
Trustwave
Nothing is preventing any organization from simply setting up shop as a CA. However, 
the certifi cates issued by a CA are only as good as the trust placed in the CA that issued 
them. This is an important item to consider when receiving a digital certifi cate from a third 
party. If you don’t recognize and trust the name of the CA that issued the certifi cate, you 
shouldn’t place any trust in the certifi cate at all. PKI relies on a hierarchy of trust relation-
ships. If you confi gure your browser to trust a CA, it will automatically trust all of the 
digital certifi cates issued by that CA. Browser developers preconfi gure browsers to trust the 
major CAs to avoid placing this burden on users. 
Registration authorities
(RAs) assist CAs with the burden of verifying users’ identities 
prior to issuing digital certifi cates. They do not directly issue certifi cates themselves, but 
they play an important role in the certifi cation process, allowing CAs to remotely validate 
user identities. 

---

Public Key Infrastructure 
251
Certificate Path validation
You may have heard of 
certificate path validation
(CPV) in your studies of certificate 
authorities. CPV means that each certificate in a certificate path from the original start or 
root of trust down to the server or client in question is valid and legitimate. CPV can be 
important if you need to verify that every link between “trusted” endpoints remains cur-
rent, valid, and trustworthy.
This issue arises from time to time when intermediary systems’ certificates expire or are 
replaced; this can break the chain of trust or the verification path. By forcing a reverifica-
tion of all stages of trust, you can reestablish all trust links and prove that the assumed 
trust remains assured.