Every business has a home state, in which its formation paperwork in filed. If a business wants to operate in a state other than its home state, it must register as a foreign entity and obtain permission.
A certificate of authority gives permission to a business formed in another state (a "foreign" entity) to operate within the borders of the authorizing state. The certificate is granted when the foreign business registers with the new state.
A certificate of authority is granted through the same entity handling incorporation, usually the secretary of state. Each state has a different procedure, but the registering business must fill out a form requesting basic business information, designate a registered agent for service of process in the state, provide a copy of its formation document and a certificate of good standing from its home state, as well as pay a filing fee. All this information is available on the state website.
Each state has business laws defining the point at which a foreign entity is "doing business" or "transacting business" within that state. Since this standard differs from state to state, it's important to check the definitions for each state the business touches. A business can be subject to penalties if found operating in a state without proper authority.