Check Your Certificates Before October 27: Chrome Is Removing an eMudhra Root

If your website’s security certificate was issued under an eMudhra root called emSign ECC Root CA – G3, Chrome visitors can start seeing a full-page security warning on Tuesday morning, October 27, 2026, Pacific time. On Thursday, October 22, eMudhra also said it is leaving the TLS certificate business, so a certificate from any eMudhra root will need a replacement plan. The check takes about two minutes.

What happened

On Saturday, October 17, a security researcher ran a test over the public database of certificate authority certificates and found that the private keys behind eight of eMudhra’s intermediate certificates were tiny numbers, weak enough for anyone to work out. Mozilla recovered the same keys on its own within hours. The researcher sent the report to Chrome, Mozilla, Apple, Microsoft and eMudhra at the same time, at 18:05 UTC.

An intermediate certificate sits between a trusted root and the certificate on your website. If someone holds its key, they can forge certificates for any site. Six of the eight issue website certificates. The other two are code-signing certificates that Microsoft trusts, so the exposure is not limited to websites.

Chrome and Firefox blocked the affected website certificates that day. Apple followed on Monday, October 19, and Microsoft on Tuesday, October 20.

Browsers were protected for a specific reason. Google reports that Certificate Transparency, a public record of certificates issued, showed no certificates from the six website intermediates before the block. Browsers that require that logging would have rejected any forged certificate.

The part that is still open: everything that is not a browser

Software that keeps its own list of trusted authorities, or never checks whether a certificate has been revoked, can go on trusting the blocked certificates until someone updates it. That includes command-line tools, programming-language libraries, container images, payment gateways, appliances and automated agents that call websites. If you maintain your own trust store, removing the G3 root is not enough by itself. Make sure it has also picked up the revocation of the eight intermediates.

Dennis Jackson, a cryptography engineer at Mozilla, keeps a running list of patched software and test sites. Start there for anything your team builds or runs.

The second step: the root itself leaves Chrome

Google also announced that it is removing emSign ECC Root CA – G3 from the Chrome Root Store. Google’s announcement expects the removal to reach all devices that rely on the Chrome Root Store on the morning of Tuesday, October 27, Pacific time. Mozilla has also removed the same root from its list.

Google’s guidance to site operators is to get a new certificate from a different certificate hierarchy that is in the Chrome Root Store before then. Chrome’s removal covers only emSign ECC Root CA – G3. Mozilla is also retiring two other eMudhra roots, emSign Root CA – C1 and emSign ECC Root CA – C3, at eMudhra’s own request under a transition plan from earlier this year, and says it is not removing emSign Root CA – G1 at this time. Google says it is closely investigating whether eMudhra’s remaining roots should stay in Chrome.

eMudhra is leaving the TLS certificate business

On October 22, eMudhra announced that its board has voted to withdraw from the global TLS certificate business. eMudhra says its G1 RSA roots will keep serving customers until the transition is complete, that revocation and status services will run until every certificate it issued has expired or been replaced, and that it will contact affected customers about free replacement certificates. It has not published dates.

On October 20, eMudhra told Mozilla that about 30,000 certificates under the G3 root need to move, about 97 percent of them issued through ACME, the protocol that automates renewal.

For you, that means a G3 certificate needs replacing before Tuesday, October 27, and a certificate from any other eMudhra root will need replacing on a schedule eMudhra has not yet given. Planning that move now is easier than doing it on a notice.

How to check in two minutes

1. Find out who issued your certificates. Ask whoever manages your hosting or IT. If you can see the certificate in your browser, open it and look at the issuer and the certification path.
2. Look for the name. From a terminal, run openssl s_client -connect yourdomain.com:443 -showcerts and search the output for “emSign” or “eMudhra”. If either appears, ask your provider which root your certificate chains to.
3. Check beyond the website. Application programming interfaces, partner integrations, load balancers, mail servers and anything that authenticates with certificates can all carry one.
4. Look at the certificate that is installed now. If your certificates renew through ACME, a scheduled renewal may not replace the certificate before the 27th.
5. Update software that carries its own trust list. Browsers are covered. Libraries, runtimes and base images are not covered until you update them.

If your certificate is affected

You need a replacement from a certificate authority whose root is in the Chrome Root Store, installed before Tuesday, October 27. Confirm the new chain in Chrome after installing.

SSL issues publicly trusted certificates and can issue a replacement. Contact our team.

One lesson for certificate owners, whichever authority you use

When every certificate you own comes from one authority, one decision upstream can break all of them on the same morning. Keeping a second authority ready, and a current list of which certificates come from where, turns a deadline like this into a routine swap. Our guide to why you need a backup certificate authority covers how.

Systems that only your own staff and machines use do not have to depend on a public authority’s decisions at all. A private certificate authority keeps them on your schedule.