# How is the identitiy of a subject in a Public Key Certificate verified by the Certificate Authority (CA)?

A general digital certificate issued by a CA might contain information about the individual/organization to whom the certificate belongs. As an example, consider this sample scenario:

This PKC contains identifying information of the individual to whom is this certificate is issued, i.e. the Name (Mario Rossi), Organization (Wikimedia), and so on. For a more concrete example, here is an excerpt of the PKC data issued to Wikimedia, containing info about their company name, address and domain:

...
Subject: C=US, ST=California, L=San Francisco, O=Wikimedia Foundation, Inc., CN=*.wikipedia.orgSubject
...


My question is what are the standards used by the CA to ensure that these claimed details about the Subject's name, address, domain, etc are genuine and not being falsely claimed by forger? Additionally, what kind of subject-related-data, in addition to names, addresses, etc., can be expected to be verfied by the CA?

• Arguably, this question is more on-topic for security-SE. Have a look at these, e.g. this, this.
– fgrieu
Dec 12 '20 at 9:08
• Actually this is part of what a Registration Authority does. An RA can be role within a CA, but it might also delegate the operation. Dec 12 '20 at 14:37