A CA operates a hierarchy: an offline root key, one or more online intermediate keys in HSMs, and the validation, issuance, revocation (CRL and, optionally, OCSP) and logging systems around them. Its rules are written in a certificate policy and practice statement (RFC 3647 format) and checked by annual audits (WebTrust or ETSI).
Publicly trusted CAs are those whose roots are in browser and operating system root stores (Mozilla, Chrome, Apple, Microsoft). They must follow the CA/Browser Forum Baseline Requirements and each root program's policy, publish all TLS certificates to Certificate Transparency and respond to incidents publicly. Root programs remove CAs that fail: DigiNotar in 2011, WoSign and StartCom in 2016–2017, Symantec's PKI in 2017–2018 and Entrust's TLS roots, which Chrome 131 stopped trusting for certificates whose earliest SCT is dated after 11 November 2024.
Private CAs (for internal services, mTLS, devices, VPNs) are trusted only where their root is installed and are not bound by public lifetime limits; tools such as step-ca, Vault PKI, AWS Private CA and the OpenSSL ca command run them.