2

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no longer honored, revoked, whatever. I got it from GoDaddy a while back and it cross-certifies to the Valicert root. It just seems to work sometimes and then sometimes I get folks tell me they have problems accessing my site. It is still on the GoDaddy root repository page but it's considered "legacy". I've been round and round with a GoDaddy rep on this and have now wasted 2 hours of my life. I really don't want to replace it if I don't have to. But I also noticed that its no longer being kept in the Windows trusted root cert store, which isn't a good sign. At least on my computer.

6

The "ValiCert Class 2 Policy Validation Authority" root from 1999, along with about a dozen other roots from ValiCert and other CAs, are being phased out because they're only 1024 bits. 1024-bit RSA is increasingly close to being breakable1, so the community has decided to get rid of them in an orderly manner by 20112 to prevent a major security incident and panic in the coming years.

Mozilla's stated policy was to disable them some time after December 31, 2013, and they have been actively working with the CAs to do so.

In other words, yes, you have to replace it. What's the problem? I realize it's unpleasant3, but you have to renew it annually anyway, and this is less work. Maybe your CA will be willing to compensate you for the inconvenience you've suffered as a predictable consequence of their decision to use an obsolescent technology long after its sell by date.

1 I wouldn't be surprised if certain agencies could factor them -- slowly -- but I might be a little paranoid.
2 Wait, what's today's date again?
3 I remember Heartbleed.

  • I read through the links you sent. Very interesting. Although it appears that all 3 of the Valicert roots still remain in Mozilla's browser trust store. The last comment made was from 5/2104 so I can only wonder if this compatibility testing has put the brakes on CA's actually pulling the certs. What is going to be the expected behavior of browsers that need to chain up to that root once they pull it or once its no longer in the browser trust store? And what's the process involved in pulling a cert? Do they just revoke it? I would think revocation would only be a first step. – user53029 Aug 16 '14 at 5:07

protected by Community Feb 23 '15 at 21:58

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.