Certificate Authority RSA key expiration? My understanding about SSL/TLS for HTTPS is that servers send their certificates to browsers and browser attempt to decrypt them using trusted CA public keys that are already presented in their store. Also our certificates are limited to an expiration date (mostly because of security).

Do Certificate Authorities need to renew their RSA keys from time to time due to security considerations?
To understand why CAs need to rotate their RSA keys less often, let's first investigate why end-users have to rotate their keys / certificate every few years.

There are three main reasons why end-users have to renew their keys / why certificates have a limited life-span.


To keep CRLs somewhat small. Expired certificates don't need to be put onto CRLs because they're invalid anyways, this the CRLs can be "constant-sized". Obviously CAs aren't hit by this because you always have an explicit list of trusted CAs.
To enforce technology renewal. From time-to-time technology changes and becomes potentially unsafe. Certificate renewal usually forces you to upgrade to more secure technologies (like RSA-2048, SHA-2, ...). The CAs are hit by this, but not because of expiry dates but rather because of pressure from the browsers. However they usually tend to have a long grace period where they put their new certs (not neccessarily with new keys) into the trust stores and gradually remove the old certs.
To allow CAs to earn money. When your certificate expires, you have to buy a new one from the CAs which brings them money. So obviously they want to limit certificate validity. Obviously CAs aren't hit by this because renewing CA keys is a lot of work and procedures and thus will be avoided at (nearly) all costs.


So the main reasons why CAs renew their keys seems to be that they have to upgrade key-length and the the main reasons why they have to renew their certificates is outdated hash functions (but in this case they usually keep on using the keys).

Now there are two more reasons why CAs have to renew keys / certs (without being put out of business due to a breach):


Issues related to their root key storage. CA root keys are stored in super-secure HSMs inside of heavily guarded vaults. Depending on the HSM in use, it runs on batteries (while it's not being actively used) and they will run out of power sooner or later. At this point you have to renew keys as well. This happens after five years earliest and depending on their setup may require new keys to be put in the trust stores or just some effort to move the keys into a new HSM (which is possible).
They "screwed up" with the expiry date. Obviously you only want to renew keys / certificates if there's a need for it and sometimes the older CAs just set their expiry date of the root certificates to something like 20 years in the future assuming there would be other reasons meanwhile to renew the certificates. But that usually doesn't happen so they keep the key and just distribute a new cert (with a much longer expiry date this time).