A certificate authority (CA) at a level beneath the root CA.
In a hierarchical Public Key Infrastructure (PKI) system,
the top of the hierarchy is held by the root CA, and other CAs beneath it are called subordinate CAs. The job of the root CA is to certify the identity of subordinate CAs by issuing them digital certificates. The subordinate CAs then are responsible for issuing certificates to users who request them; the root CA generally is not involved in servicing such user certificate requests at all. In some implementations certain subordinate CAs also might be assigned other roles such as issuing certificates for applications or smart cards. Because a subordinate CA issues certificates in response to certificate requests, it is sometimes called an “issuing CA” instead.