I have an older blog post that goes in to a little detail on what a CA is and how it works: https://scotthelme.co.uk/impending-doom-root-ca-expiring-leg...