Google’s October 20 notice says removal of eMudhra’s emSign ECC Root CA - G3 should reach devices using the Chrome Root Store on Tuesday morning, October 27, 2026, PDT; prerelease channels may receive it sooner. Legitimate certificates under that root can stop working in Chrome.
This is a stated rollout expectation, not confirmation of worldwide completion.
The Breakdown
A website certificate helps a browser check the identity of the site it is contacting. An intermediate certificate authorises an issuer to sign certificates; the chain leads back to a root that the browser accepts. Its collection of accepted roots is a trust store. Mozilla’s developer documentation describes this chain as the basis for checking the issuer behind a website certificate.
A root can support several intermediates. Distrusting it can reject a legitimate certificate issued through another intermediate, even when the affected intermediates issued no website certificates.
eMudhra’s statement updated through October 21 concerns eight intermediates with weak keys. It says one entered production but none issued end-entity certificates: the certificates used by websites or other final recipients. Its root keys and other intermediates were unaffected, it says. The investigation continues.
What the public accounts establish
CERT-In’s October 21 advisory says the cited public disclosures had not established confirmed malicious exploitation. That statement does not rule out all exploitation or possible service disruption.
Google found no website-security (TLS) certificates from the six affected TLS intermediates in the Certificate Transparency logs it checked before blocking. Its protection conclusion applies to clients enforcing those log requirements.
Mozilla’s October 20 security advisory says Firefox 158.0.1 includes its updated OneCRL certificate block list for clients unable to receive that protection through its remote-update service. Availability of an update does not establish installation everywhere.
CERT-In distinguishes browser-trusted certificates from India’s digital-signature certificates and eSign services regulated by the Controller of Certifying Authorities. Its advisory says those domestic services are not affected. That boundary is not a finding about every Indian website using global browser trust.
Update: October 22, 2026
eMudhra’s board has decided to withdraw voluntarily from the global SSL/TLS certificate business, according to its October 22 filing. This is an announced exit with a customer transition, not confirmation that the withdrawal is complete. The company says it will arrange replacement certificates for affected customers through partners without charge and maintain revocation and certificate-status services until issued certificates expire or are replaced. It also says it will complete its remaining browser-program commitments, including a full root-cause report. The filing gives no calendar deadline for completing the transition.
The Crunch
For an operator, the useful check is with the authorised IT team or certificate provider: does our service use this root, and if so, what replacement and testing are needed? CERT-In recommends reviewing certificate dependencies and replacing chains that will no longer be trusted. Certificate warnings should not be bypassed or validation switched off.
A check of the actual chain is more useful than assuming that a company name makes every service affected.