Cyber ·
Removal of Comodo AAA Services root is not tied to the eMudhra incident
An oss-sec mailing list message dated October 20, 2026 states that removing the Comodo AAA Services root from browser trust stores is unrelated to the eMudhra intermediate certificate compromise. The cited reason is the root's age, issued in 2004.
A message posted to the oss-sec mailing list on October 20, 2026 states that removing the Comodo AAA Services root from browser trust stores is not related to the eMudhra intermediate certificate compromise incident. According to the text, the problem with that root was browsers removing its TLS trust indicator because the root is too old. The message cites current CA/Browser Forum Baseline Requirements, which limit a root's validity to 15 years from its creation date. The Comodo AAA Services root was issued in 2004 and, according to the author, violates that policy. The reported facts are the date, the stated cause of removal, and the cited policy limit. The text gives no further technical detail about the eMudhra incident.
For teams that operate systems relying on certificate chains, the relevance is to keep the two events separate when assessing risk, since retiring an old root and a compromise of intermediates have different causes and effects. To verify, read the original message in the public oss-sec mailing list archive, check its date, and confirm the details against official statements from browser vendors and the certificate authorities involved.
Original source: Re: Comprometimento de certificados intermediários da eMudhra