A certification authority approved under SHAKEN governance to issue the X.509 certificates that voice providers use to sign calls.
An STI-CA is the SHAKEN equivalent of a certificate authority on the web, but with a narrower and more tightly governed role. It issues certificates only to providers that present a valid SPC token from the Policy Administrator, and the certificates it issues tie the signing key to that provider's Service Provider Code through a TNAuthList extension, as described in RFC 8226.
Certificates are typically requested and renewed through automated protocols built on ACME, with the SPC token serving as proof that the requester is authorized. The resulting public certificate must be published at a reachable HTTPS URL so that verifiers can retrieve it when they see the "x5u" or "info" value in an Identity header.
Only certificates chaining to a CA on the Policy Administrator's trusted list will verify successfully. Providers can choose among approved CAs, and many signing platforms handle the CA relationship on the provider's behalf, though the certificate must still be issued in the provider's own name. Providers should confirm, rather than assume, that any certificate used to sign their traffic identifies them as the subscriber, since FCC rules expect providers to authenticate calls using their own credentials.
Why it matters to carriers
Expired certificates, unreachable certificate URLs, and certificates issued to the wrong entity are all common causes of verification failures that look, to the terminating side, exactly like spoofed calls. Monitoring certificate expiry and the availability of your certificate repository should be part of routine network operations, not an annual scramble.