What is CA?

A CA (Certificate Authority) is the party that signs certificates, and its signature is what makes a certificate trusted by everyone who trusts the CA.

A certificate binds a name (a website, a server, a VPN user) to a public key. On its own it proves nothing, because anyone can create one. What makes it trustworthy is a CA's digital signature: a client that trusts the CA's own certificate can check that signature and know the CA vouched for this name and key. Web browsers trust a few hundred public CAs, which is why any website can get a certificate browsers accept. Private systems such as a company VPN usually run their own CA instead, trusted only by their own servers and users. That's simple to set up with a tool like easy-rsa, and nobody outside can issue certificates for it.

Running your own CA means guarding its private key above everything else: anyone who has it can create a certificate for any user, and every server that trusts the CA will accept it. Good practice is a passphrase on the key and, ideally, keeping the CA on a separate machine that only ever signs requests. A CA also publishes a CRL listing the certificates it has revoked. The OpenVPN on Debian lesson builds a CA with easy-rsa, issues a certificate per user, and revokes one.