Cyber ·
Questions on trust in the Comodo AAA certificate after eMudhra intermediaries were compromised
A thread on the oss-sec list dated 21 October 2026 asks why Firefox 153 ESR still trusts the Comodo AAA certificate, even though web trust was disabled in NSS last year.
According to a machine translation of a message posted to the oss-sec list on 21 October 2026, the discussion concerns the compromise of eMudhra intermediaries and the trust placed in the Comodo AAA certificate. One participant says they could not find the cross-signing requirement mentioned in the debate in the CA/B BR policies. They report that the certificate was not removed from the NSS store, but that the web trust option was disabled last year, according to a Mozilla Bugzilla report. Even so, Firefox 153 ESR, which should include that change, still trusted the certificate, which the author describes as an inconsistency they cannot explain.
To consult and verify, find the original thread in the public 2026 archive of the oss-sec list and the bug cited in Mozilla Bugzilla, which records the trust change. Check the date of each message, the exact ESR version and the current status of the bug before drawing any conclusion. The text is an open discussion among participants, not an official fix notice, and it does not present a confirmed technical conclusion.
Original source: Re: Comprometimento de intermediárias da eMudhra