eMudhra exits TLS certificates: check yours before October 27

On October 22, 2026, the Bengaluru-based certificate authority eMudhra announced it is leaving the global TLS certificate market. Two days earlier, Chrome had announced the removal of eMudhra's emSign ECC Root CA - G3 root, scheduled for Tuesday, October 27, 2026. If your site serves a certificate issued by eMudhra, replace it now.

⚡TL;DR

• On October 17, 2026, a researcher reported that eight eMudhra intermediate certificate authorities had private keys generated with insufficient randomness. Chrome blocked the six used for TLS that same evening. According to eMudhra, none of the eight had issued an end-entity certificate.
• Chrome is removing the emSign ECC Root CA - G3 root from its root store on the morning of Tuesday, October 27, 2026, Pacific Time. Legitimate certificates that depend on it will then stop working in Chrome.
• eMudhra is leaving the global TLS certificate market. Beyond Chrome's requirement for G3, we advise replacing any TLS certificate issued by eMudhra with one from another authority, without waiting for it to expire.

What happened

On Saturday, October 17, 2026, at 18:05 UTC, Chrome's root program received a report from a security researcher: the private keys of eight eMudhra intermediate certificate authorities had been generated with insufficient randomness. With those keys, anyone could forge an HTTPS certificate for any site, accepted by clients that still trusted these authorities. According to Scott Helme, the eight intermediates (six for TLS, two for code signing) dated from April 2025 and had been cross-signed in May 2025 by Sectigo's AAA Certificate Services root.

At 19:45 UTC, Chrome pushed a CRLSet update, which blocks the public keys of the six TLS intermediates without requiring a browser update or restart. Firefox blocked them via OneCRL a few hours later, according to Scott Helme. eMudhra says it revoked the affected authorities within 14 hours of the discovery and states that they issued no end-entity certificates. For its part, Chrome says that no TLS certificate chaining to the six TLS intermediates had been logged in Certificate Transparency before the block.

On October 20, Chrome removed the root that had signed the TLS intermediates, emSign ECC Root CA - G3, from its root store (Chrome Root Store). The removal should reach all devices that rely on this store on the morning of Tuesday, October 27, 2026, Pacific Time (PDT), and earlier on Chrome Canary and Chrome Beta. Chrome warns that legitimate certificates chaining to this root will stop working in its browser. The same day, Mozilla announced in its incident ticket that it was urgently removing its trust in emSign ECC Root CA - G3, but not, at this stage, in emSign Root CA - G1.

On October 22, eMudhra's board of directors decided to voluntarily exit the global SSL/TLS certificate market, which the company says accounts for about 1% of its revenue. Its G1 RSA roots keep serving customers until the end of the transition, for which no date has been published. eMudhra says it will contact affected customers to replace their certificates free of charge with certificates from partners, which it does not name. Its revocation and status services will stay online until every certificate it issued has expired or been replaced.

Who is affected

Any site that serves a TLS certificate issued by eMudhra, in either of these two cases:

• The certificate chains to emSign ECC Root CA - G3. It will stop working in Chrome on October 27. Chrome asks the operators of these sites to immediately install a certificate from another hierarchy included in its root store.
• The certificate chains to a G1 RSA root. It still works, but eMudhra is exiting TLS: these roots only serve for the duration of the switchover, with no published end date. Chrome is also reviewing whether eMudhra's other CA certificates stay in its store.

A certificate issued by another authority is not affected by this removal.

How to check

For a given hostname, the CaptainDNS SSL Certificate Checker shows the Issuer field of the served certificate (common name and organization) and the name of each intermediate the server sends. Without a CaptainDNS account, the Issuer and the chain stay hidden. Create a free account to see the details.

• If the Issuer organization mentions eMudhra or emSign, the certificate comes from eMudhra and it is affected. This is the reliable clue: an intermediate's name does not always contain eMudhra or emSign.
• The line "Root (system store): chains up to a recognized root" does not mean Chrome accepts the certificate. It reflects the certificate store of the server running the test, not the Chrome Root Store, and the tool does not name the root.
• If the tool reports a missing intermediate, only the Issuer field remains usable.

You don't need to know which root is involved to decide: an eMudhra certificate needs replacing in every case, and doing it before October 27 also takes care of the G3 case. If you manage many hostnames, start from your certificate inventory, as described in our certificate lifecycle management guide.

What to do

1. Order a certificate now from another certificate authority included in the Chrome Root Store. Don't wait for the eMudhra certificate to expire: its issuer is leaving this business.
2. If your DNS zone publishes a CAA record, add the new authority's identifier to it before ordering, or the authority will refuse to issue. The syntax is covered in our complete guide to CAA records.
3. Install the new certificate with its full chain, then check the served chain: the Issuer must carry the new authority's name.

According to eMudhra (Mozilla ticket of October 20), about 30,000 certificates chaining to G3 need to be migrated, 97% of them obtained via ACME. If your ACME client, such as Certbot or acme.sh, points to eMudhra, switch to another authority in its configuration, or the automatic renewal will go back to eMudhra.

eMudhra's free replacement offer exists, but with no timeline and no partner name. For a certificate chaining to G3, our advice at CaptainDNS: don't wait for that contact if it hasn't come before October 27.

Read the Issuer and the intermediates served by each of your hostnames.

What this article is not

It does not cover eMudhra's electronic signature business. According to the company, its digital signature certificates (DSC), eSign and its other signature services, including in India, its enterprise PKI (emCA, CertiNext), emSigner, SecurePass and emAS are not affected.

It does not report a flaw in your site either: the weak keys belonged to eight eMudhra intermediate authorities. Replacing your certificate is about changing issuers. Finally, it does not cover updating the certificate stores of servers, scripts and devices (curl, Python, Node) that, by default, check neither revocation nor Certificate Transparency. Scott Helme covers that side in his post.

FAQ

My eMudhra certificate still works: do I need to replace it?

Yes. eMudhra is leaving the TLS certificate market, and its G1 RSA roots only serve for the duration of the transition, with no published end date. If the certificate chains to emSign ECC Root CA - G3, it will stop working in Chrome on Tuesday, October 27, 2026. Replace it before that date with a certificate from another authority.

Were fraudulent certificates issued with the weak keys?

eMudhra states that the eight intermediates involved issued no end-entity certificate. Chrome says that no TLS certificate chaining to the six TLS intermediates had been logged in Certificate Transparency before its block: no fraudulent certificate could have been used against a client that requires Certificate Transparency, such as Chrome.

Are my eMudhra electronic signatures (DSC, eSign) affected?

No, according to eMudhra. The company says its TLS infrastructure is separate and that its digital signature certificates, eSign, emSigner, its enterprise PKI and its identity solutions continue to operate normally. The announced exit only concerns SSL/TLS certificates.

Will I have to pay to replace my certificate?

eMudhra says it will contact affected customers to replace their certificates free of charge with certificates from partners, without naming those partners or giving a timeline. Nothing stops you from choosing another authority yourself. If you do, remember to authorize it in your CAA record.

Sources: eMudhra press release of October 22, 2026, Chrome Security blog post of October 20, 2026, Scott Helme's analysis of October 20, 2026 and Mozilla incident ticket.