The issuing authority can be an external, public third party that sells certificates or an internal certification authority that is hosted by your organization.