Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no longer honored, revoked, whatever. I got it from GoDaddy a while back and it cross-certifies to the Valicert root. It just seems to work sometimes and then sometimes I get folks tell me they have problems accessing my site. It is still on the GoDaddy root repository page but it's considered "legacy". I've been round and round with a GoDaddy rep on this and have now wasted 2 hours of my life. I really don't want to replace it if I don't have to. But I also noticed that its no longer being kept in the Windows trusted root cert store, which isn't a good sign. At least on my computer.
The "ValiCert Class 2 Policy Validation Authority" root from 1999, along with about a dozen other roots from ValiCert and other CAs, are being phased out because they're only 1024 bits. 1024-bit RSA is increasingly close to being breakable1, so the community has decided to get rid of them in an orderly manner by 20112 to prevent a major security incident and panic in the coming years.
In other words, yes, you have to replace it. What's the problem? I realize it's unpleasant3, but you have to renew it annually anyway, and this is less work. Maybe your CA will be willing to compensate you for the inconvenience you've suffered as a predictable consequence of their decision to use an obsolescent technology long after its sell by date.
1 I wouldn't be surprised if certain agencies could factor them -- slowly -- but I might be a little paranoid.
2 Wait, what's today's date again?
3 I remember Heartbleed.