Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I know that CAs use intermediate certificates to mitigate the impact of potentially having to revoke a root CA (i.e., the need to update all browser clients on peoples computers allover the world).
But nevertheless, a root Certificate will sooner or later have to be revoked, after maybe 15 years or so. How is this done to minimise disruption to communications?
Root certificates don't need to be revoked unless they are compromised. In case they are compromised they can be revoked by placing them on a blacklist within e.g. a browser, or by removing them altogether. Obviously it's not possible to just create a CRL as there would not be a trusted private key; instead this is a out-of-order operation.
In general it's better to create a new root certificate and let the old one expire. Note that the underlying certificates should have an expiration date that is lower or equal to the expiration date of their parent. Of course the new root certificates need to be communicated securely to e.g. the browser manufacturers. How this can be done is generally communicated by the browser manufacturers, e.g. see the Mozilla policy here.
