I was looking at various CAs and they always have a paged dedicated to list "retired roots".

For example: https://www.thawte.com/roots/retired.html

Does it mean these certificates should not be trusted now? Or does it mean CA will not renew the root once the certificate expire?

2 Answers 2


All of the certificates described on the retired roots page today have 1024-bit RSA keys (except for the one which says 1025) and were self-signed with either md5WithRSAEncryption or sha1WithRSAEncryption.

The most likely interpretation is "we are not self-revoking these roots, certificates which chain to them are not inherently untrustworthy, but you need to make an application decision to trust them; however, we will not issue any further certificates which chain to these roots".


Retired indicates the certificates are no longer in use, but not compromised and so not revoked. They may also be retired due to expiration. Each CA also publishes a "CPS" or certification practice statement that describes the business and operations conditions that guide or dictate when various events (like retiring an issuing certificate) take place.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .