Certificate Authority RSA key expiration?

Question

My understanding about SSL/TLS for HTTPS is that servers send their certificates to browsers and browser attempt to decrypt them using trusted CA public keys that are already presented in their store. Also our certificates are limited to an expiration date (mostly because of security).

Do Certificate Authorities need to renew their RSA keys from time to time due to security considerations?

Answer 1

To understand why CAs need to rotate their RSA keys less often, let's first investigate why end-users have to rotate their keys / certificate every few years.

There are three main reasons why end-users have to renew their keys / why certificates have a limited life-span.

• To keep CRLs somewhat small. Expired certificates don't need to be put onto CRLs because they're invalid anyways, this the CRLs can be "constant-sized". Obviously CAs aren't hit by this because you always have an explicit list of trusted CAs.
• To enforce technology renewal. From time-to-time technology changes and becomes potentially unsafe. Certificate renewal usually forces you to upgrade to more secure technologies (like RSA-2048, SHA-2, ...). The CAs are hit by this, but not because of expiry dates but rather because of pressure from the browsers. However they usually tend to have a long grace period where they put their new certs (not neccessarily with new keys) into the trust stores and gradually remove the old certs.
• To allow CAs to earn money. When your certificate expires, you have to buy a new one from the CAs which brings them money. So obviously they want to limit certificate validity. Obviously CAs aren't hit by this because renewing CA keys is a lot of work and procedures and thus will be avoided at (nearly) all costs.

So the main reasons why CAs renew their keys seems to be that they have to upgrade key-length and the the main reasons why they have to renew their certificates is outdated hash functions (but in this case they usually keep on using the keys).

Now there are two more reasons why CAs have to renew keys / certs (without being put out of business due to a breach):

• Issues related to their root key storage. CA root keys are stored in super-secure HSMs inside of heavily guarded vaults. Depending on the HSM in use, it runs on batteries (while it's not being actively used) and they will run out of power sooner or later. At this point you have to renew keys as well. This happens after five years earliest and depending on their setup may require new keys to be put in the trust stores or just some effort to move the keys into a new HSM (which is possible).
• They "screwed up" with the expiry date. Obviously you only want to renew keys / certificates if there's a need for it and sometimes the older CAs just set their expiry date of the root certificates to something like 20 years in the future assuming there would be other reasons meanwhile to renew the certificates. But that usually doesn't happen so they keep the key and just distribute a new cert (with a much longer expiry date this time).

Answer 2

Yes that could happen, but usually it doesn't happen frequently that CA certs are replaced because of security considerations.

Root certificates - the top level certificates - usually have a very long validity period. Replacing a root certificate is a out-of-band process. For instance, for browsers it means putting it into the default certificate store distributed within the browser installation. As they are commonly only used to create the CA certificates below them, they can be securely stored in a safe somewhere (all the more reason to use a secure, up to date browser). Even MD5 certificates may still be secure if the signed certificates are only created internally within the CA.

Of course it might be that certificates need to be replaced earlier than the "valid-to" date. For instance the signature or hash algorithms may need to be replaced or it is suspected that the key has leaked. For any other certificates than CA certificates the old certificates can be marked invalid in a CRL (Certificate Revocation List) or through OCSP (Online Certificate Status Protocol). CA certificates can be part of a chain that lead to the trusted root certificate; they do not have to be distributed with browsers, they can be received and verified during authentication.

As CA certificates may sign end user certificates (or other intermediate CA certificates) that are from a semi-trusted source there is a higher need to make sure that the signature algorithms supported by the certificate are secure. Of course CA certificates are more likely to be kept secure than end user certificates, so the (expected) loss of the private key should happen less often. If the security practices of the CA itself are sufficiently lacking there may not be any time to renew certificates, by the way.

So yes, CA certificates must be renewed from time to time, because there are security related issues or because they are near the date of expiry (usually there is some overlap between certificates validity period to allow everybody to switch).