I know that CAs use intermediate certificates to mitigate the impact of potentially having to revoke a root CA (i.e., the need to update all browser clients on peoples computers allover the world).

But nevertheless, a root Certificate will sooner or later have to be revoked, after maybe 15 years or so. How is this done to minimise disruption to communications?

  • Please keep in mind the difference between revoking a certificate and expiration of a certificate.
    – user
    Oct 1, 2016 at 18:45

1 Answer 1


Root certificates don't need to be revoked unless they are compromised. In case they are compromised they can be revoked by placing them on a blacklist within e.g. a browser, or by removing them altogether. Obviously it's not possible to just create a CRL as there would not be a trusted private key; instead this is a out-of-order operation.

In general it's better to create a new root certificate and let the old one expire. Note that the underlying certificates should have an expiration date that is lower or equal to the expiration date of their parent. Of course the new root certificates need to be communicated securely to e.g. the browser manufacturers. How this can be done is generally communicated by the browser manufacturers, e.g. see the Mozilla policy here.

  • "Root certificates don't need to be revoked if they are not compromised ..." But I see in my browser that several of the roots are due to expire about 20 years from today. I guess this means they could be expired due to age, even when no known breach exists. Is it possible for a CA to have more than one root? Because, if this is possible, then a given CA could slowly migrate all its users to a new root several years before the old root expires.
    – Minaj
    Jul 25, 2016 at 1:03
  • haha. Interesting !
    – Minaj
    Jul 25, 2016 at 1:31
  • Yes of course. In general CA's do have more roots. Just take a look at the root certs in any browser (or, in the case of IE, in the certificate store of the user in the OS). Oct 1, 2016 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .