eMudhra intermediate certificate compromise and removal of the Comodo AAA Services root

What happened and what to do

The post, published on 20 October 2026 on the oss-sec list by Jeffrey Walton, covers two separate matters. The first is the compromise of eMudhra intermediate certificates. The second is the removal of the Comodo AAA Services root from browser trust stores, which the author says is not related to that incident. The root was removed because it was issued in 2004 and, under current CA/Browser Forum Baseline Requirements, a root may not have a validity period longer than 15 years from its creation date.

In practice, organizations that rely on certificate chains should evaluate these two events separately. One possible action is to inventory every certificate and chain used in internal systems, APIs, integrations and customer applications, identifying which depend on eMudhra intermediates or on older roots such as Comodo AAA Services. That inventory can feed a monitoring pipeline that checks validity, issuer and trust chain and raises alerts before connection failures occur. It is also worth reviewing CA bundles pinned in custom software, containers and devices, since roots removed from browsers may persist in local stores and cause inconsistent behavior.

How the consultancy can help

Wendelmaques can diagnose your organization's exposure to affected certificate chains by mapping certificates, issuers and trust stores. It then designs and implements continuous validity and chain monitoring, with alerts and a rotation and replacement plan, operated in your own environment.

Next step

If your organization uses certificates issued by eMudhra or relies on older roots, send a short description of your setup, including systems, certificate volume and environments involved. We will prepare a scoped diagnosis and implementation proposal.