Operation of a certificate authority on a distributed ledger

A method of issuing a ledger certificate to a subject performed by a node of a distributed ledger operated by a certificate authority, the ledger certificate asserting attributes of the subject, one or more of the asserted attributes having been verified to the satisfaction of the certificate authority, the ledger certificate comprising a ledger address of an on-ledger certificate revocation store that enables an on-ledger verifier to validate the ledger certificate by verifying that a unique identifier of the ledger certificate is not present in a local replica of the on-ledger certificate revocation store, the method of issuing the ledger certificate comprising issuing a certificate issuance transaction on the distributed ledger, the certificate issuance transaction containing an instruction to store a validation hash of the ledger certificate in an on-ledger certificate issuance store, the instruction being executable by an on-ledger verifier in a local replica of the on-ledger certificate issuance store upon the certificate issuance transaction being propagated to the on-ledger verifier, wherein a ledger address of the on-ledger certificate issuance store is included in a parent certificate whose subject is the certificate authority.