CAs must revoke Certificates that they have issued upon the occurrence of any of the following events:
the CA obtains reasonable evidence that the subscriber’s private key (corresponding to the public key in the certificate) has been compromised or is suspected of compromise (e.g. Debian weak keys), or that the certificate has otherwise been misused;
http://www.mozilla.org/en-US/about/governance/policies/secur...
Section 2, dot 2.
CAs must revoke Certificates that they have issued upon the occurrence of any of the following events:
the CA obtains reasonable evidence that the subscriber’s private key (corresponding to the public key in the certificate) has been compromised or is suspected of compromise (e.g. Debian weak keys), or that the certificate has otherwise been misused;