A Sub CA is a Certification Authority whose certificate has been signed by a higher-level CA. Depending on the PKI structure, it can issue certificates for additional subordinate CAs or end-entity certificates for users, devices, servers, and applications.