Cyber ·
Removing TLS trust from a Comodo AAA root did not stop S/MIME use, oss-sec notes
A message dated 24 October on the oss-sec feed clarifies that removing TLS trust from a root certificate did not necessarily prevent its use for S/MIME. The thread concerns intermediates linked to eMudhra and corrects details about the root's validity period.
A message posted by Jeffrey Walton to the oss-sec feed on 24 October 2026, replying to a thread about the compromise of eMudhra intermediates. The author clarifies that removing TLS trust from a root did not necessarily prevent its use for S/MIME. According to the text, TLS trust for the Comodo AAA Services root was removed in April 2025, which took it out of browser trust stores and some tools, but the certificate could still be used for S/MIME. The author also corrects an error about validity: the notAfter is specified in section 7.1.2.1.1 of the CA/B Forum Baseline Requirements, on root CA validity, and equals 25 years. The message is cut off where it explains the reason. To verify, consult the original message in the October 2026 oss-sec archive and the CA/B Forum Baseline Requirements it cites.
Original source: Re: Comprometimento de intermediárias da eMudhra