A CA signs certificates. A client trusts a certificate if a chain of signatures leads to a CA in its trust store (or one given with -CAfile). A private CA made for a demo or an internal network works the same way, only your machines trust it.