An entity that identifies and authenticates certificate subjects on behalf of a certification authority, but does not issue or sign certificates.