# Analysis of Certificate Authority Incident Trends Since 2017 New data reveals a decline in self-reported security incidents among certificate authorities. - **Source:** [Technical Information Security Content & Discussion](https://brifing.si/source/00707f34-d14e-4e4d-a6f0-2cd451bd38f7) - **Published:** 2026-11-09 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/73598167-92d3-44ae-bfe6-87a1b5ea01e8 ## Rising Incident Volume The year 2026 has already become the busiest period for certificate authority incidents, recording 338 cases as of November 7. This dataset, which tracks every TLS incident within Mozilla's CA program since 2017, highlights a total of 1,581 recorded events, reflecting increasing scrutiny and reporting frequency across the entire digital ecosystem. ## Declining Self-Detection Rates Certificate authorities are identifying fewer of their own security incidents compared to previous years. In 2026, CAs discovered only 17% of their own issues, a significant drop from 29% in 2025. This downward trend is stark when compared to 2022, when authorities were responsible for detecting 59% of their own security failures. ## External Oversight Dominance Because self-detection rates have plummeted, external entities now identify the vast majority of certificate authority incidents. Researchers, root programs, and other independent third parties are responsible for uncovering the remaining 83% of cases in 2026. This shift underscores the critical role of external audits in maintaining the integrity of web security. ## Critical Incident Rarity Despite the high volume of reported incidents, severe security failures remain exceptionally rare within the monitored dataset. Only 11 incidents out of the 1,581 total entries are classified as critical. This suggests that while operational errors are frequent, the core security infrastructure managed by these authorities remains largely resilient against catastrophic failure. ## Key Control Vulnerabilities The dataset highlights a specific instance involving eMudhra, where the authority lost control of its own computable keys. This remains the only incident in the entire 2017 to 2026 collection where a CA failed to maintain secure custody of its cryptographic keys, marking a unique and highly significant security breach in the records. ## Mozilla Program Context The data is derived specifically from the Mozilla CA program, which sets the standards for certificates trusted by the Firefox browser. By tracking these incidents, the program maintains transparency regarding the operational health of global certificate authorities. This oversight is essential for ensuring that encrypted web traffic remains secure for all end users. ## Operational Security Trends The transition from internal discovery to external identification indicates a potential gap in the internal monitoring capabilities of certificate authorities. As the number of incidents grows, the reliance on external researchers suggests that current automated internal systems may not be keeping pace with the complexity of modern certificate management and compliance requirements. ## Future Security Outlook Moving forward, the industry must address why internal detection mechanisms are failing to catch incidents before third parties do. With 2026 setting a record for incident volume, the focus will likely shift toward improving internal audit processes and strengthening the cryptographic controls that prevent the loss of sensitive signing keys globally. ## Sources covering this story - https://www.reddit.com/r/netsec/comments/1xrsyyg/certificate_authority_list_every_cas_incident/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._