Resolution criteria

This market resolves to YES if, between October 21, 2026, and December 31, 2027, at 23:59 UTC, at least one Certificate Authority (CA) trusted in the major Web PKI ecosystem experiences an incident involving the exposure, generation weakness, or compromise of one or more intermediate CA (subordinate CA) or root CA private keys that meets both of the following conditions:

1. Root / Intermediate Key Compromise or Flaw: The private key of at least one publicly trusted intermediate or root CA is confirmed to have been compromised, leaked, or generated with cryptographic weaknesses (e.g., trivial key recovery, bad RNG, hardcoded/small scalar values) enabling unauthorized parties to forge TLS/SSL or code-signing certificates.

2. Emergency Ecosystem Distrust / Revocation: At least two major browser or root store operators (Google Chrome, Mozilla Firefox, Apple, or Microsoft) deploy emergency technical revocations or distrust blocks (such as additions to Chrome CRLSets, Firefox OneCRL, Apple security updates, or Microsoft CTL) specifically targeting the affected CA key(s) or certificates, outside of routine, planned certificate expirations or orderly commercial phase-outs.

Otherwise, this market resolves to NO.

Resolution Sources:

• Mozilla Security Blog (blog.mozilla.org/security)

• Google Chrome Root Program / Security Blog (security.googleblog.com)

• Mozilla Bugzilla CA incidents tracker (bugzilla.mozilla.org)

• Official announcements from Apple Security, Microsoft Security, or CCADB (Common CA Database).

Background

In October 2026, security researchers disclosed that eight intermediate CA private keys belonging to Indian certificate authority eMudhra (used for TLS and code-signing) were generated using critically weak elliptic curve private keys (with scalars as small as a single byte). This flaw allowed researchers to reconstruct the private keys and produce valid signatures.

Major root program members—including Mozilla, Google Chrome, Apple, and Microsoft—alongside runtime ecosystems like the Go project, issued emergency revocations and out-of-band updates (via mechanisms such as Firefox's OneCRL and Chrome's CRLSets) to block trust in the compromised intermediate keys and associated certificates before fraudulent end-entity certificates could be trusted across the Web PKI.