To be clear, emSign is another name for EMudhra, and Comodo is now known as Sectigo. (You can't just look at the organization name in a certificate subject; you have to consult the CCADB: https://www.agwa.name/blog/post/the_certificate_issuer_field...)

▲ eqvinox 2 hours ago | parent | next [-]

Slightly funny about this: even Wayne (the person who reported it to Chrome & Mozilla) got confused [https://bugzilla.mozilla.org/show_bug.cgi?id=2083449]:

  2026-10-17 20:18 - Full CCADB check finds the cross-signs by Sectigo are also affected

(…the "cross-signs" use the same keypair of course.)

▲ e28eta 2 hours ago | parent | prev | next [-]

Love this quote:

Inclusion in the Chrome Root Store requires that a CA Owner continuously demonstrate the technical competence and operational rigor necessary to protect Chrome users. Due to the seriousness of this incident, the Chrome Root Program is conducting a thorough evaluation regarding the status of eMudhra’s remaining CA certificate to ensure these standards continue to be met. We will share further updates as our review progresses.

from a post on https://groups.google.com/a/mozilla.org/g/dev-security-polic...

	▲	oasisbob 2 hours ago \| parent [-]
		It's been a while since there was a good CA death penalty case. Given Wayne's hints in the timeline that this issue was discovered by an agent, it might be one of the first big corporate death sentences due to AI?

▲ sippingabonedry 3 hours ago | parent | prev | next [-]

Since they are also a root CA, are they allowed to audit themselves, or do the browser root programs require third-party audits?

I can't imagine one part of a business being on the up and up, and the guys down the hall running completely rogue.

	▲	agwa 2 hours ago \| parent [-]
		Third party audits from a qualified auditor are required, although the CA chooses and pays the auditor, and the auditors are basically just accountants. So it's... not a perfect system.

▲ eqvinox 3 hours ago | parent | prev [-]

Argh. Thanks for clearing that up.