eMudhra's full incident report: one HSM-migration script broke 8 ECDSA keys and forced revocation of 8 RSA intermediates too; G1 issuance stops by Nov 16
- Missed early warning: the report ties a May-June 2025 CRL signature anomaly on the G3B/G3C intermediates (Bug 1970728) to the same defect; it was fixed at the signature level without finding the cause.
- Also affected: eight Sectigo (AAA Certificate Services) cross-certificates of the ECDSA set.
- Check: if you rely on code signed by or TLS certificates chaining to the EM G2C issuers, confirm you have replacements; the affected end-entity set can be rebuilt from Certificate Transparency by issuer.
- Opinion, from Bugzilla discussion (not eMudhra): commenters question why intermediate keys were exported at all rather than generated fresh on the new HSMs.
Sources: eMudhra full incident report, Mozilla Bugzilla 2083449 comment 82 (Nov 10, 2026) · eMudhra: Certificate security incident page · BleepingComputer: eMudhra revokes 8 more CA certificates after private key mishap (Nov 11, 2026)