Certificate authority list: every CA's incident record since 2017
Source Reddit NetSec
Discussion
This report summarizes every TLS certificate authority (CA) incident recorded in Mozilla's CA program from 2017 through November 2026, totaling 1,581 incidents across 108 CAs. The dataset highlights incident counts, self-reporting rates, late revocations, and slow response metrics per CA. While 2026 is the busiest year with 338 incidents, only 11 incidents are classified as critical, with eMudhra's computable keys incident being the sole case where a CA lost control of its own keys. The report provides comparative incident rates normalized by peak certificate issuance per CA, revealing significant variance in incident frequency and response quality among CAs. Some CAs have been distrusted due to their incident records. This dataset is intended for transparency and analysis of CA operational security over time.
r/netsec (opens in a new tab)u/certkit0 points0 comments
CAs found 17% of their own incidents in 2026 so far, down from 29% last year and 59% in 2022. Researchers, root programs, and other outsiders found the rest.
That's from a dataset we built of every TLS incident in Mozilla's CA program since 2017 (1,581 as of November 7). 2026 is already the busiest year, with 338. Only 11 incidents in the whole set are critical, and eMudhra's computable keys are the only one where a CA lost control of its own keys.