Definition
A Certificate Authority is an organization whose job is to vouch for identities on the internet. When you connect to a VPN server or a website over TLS, the server presents a certificate that includes its public key and a signature from a CA. Your device has a built-in list of trusted CAs (the root store), and if the certificate chain leads back to one of those roots, the connection is trusted. If not, the connection is rejected with a security warning.
How It Works in a VPN
Commercial VPN providers typically run their own internal CA. They issue a certificate to each VPN server, embed the CA's public key in the client app, and the client uses that key to verify the server during the handshake. This prevents a Man-in-the-Middle attack: an attacker who intercepts the connection cannot present a forged certificate because they do not have the provider's private CA key. Some VPN providers also issue per-user client certificates — proving the client's identity to the server in addition to the other direction.
Public CAs vs Private CAs
Public CAs (DigiCert, Let's Encrypt, GlobalSign) are trusted by all mainstream operating systems and browsers out of the box. They are useful for public-facing websites. Private CAs are appropriate for closed ecosystems like a VPN provider's internal infrastructure or a corporate network where every device is managed and configured to trust the internal root.