The keys of eight eMudhra intermediate CAs turned out to be weak. Major browsers blocked them within days, and about 30,000 certificates must be replaced.
In mid-October 2026, one certificate issuer — eMudhra, a certificate authority (CA) from India — suffered a serious incident: the private keys of eight of its intermediate CAs turned out to be weak. Within days, Google, Apple, Microsoft, and Mozilla blocked that certificate chain. For website owners the meaning is simple: certificates from that chain now trigger a "not secure" warning in browsers.
Why weak keys are dangerous
Every SSL certificate is signed by a CA. Browsers trust a certificate because they trust the CA that signed it — a chain of trust that ends at a root stored in browsers and operating systems. Intermediate CAs are the links in the middle, used day to day to sign customer certificates.
If an intermediate CA's key is weak, someone else could potentially forge that CA's signature and issue fake certificates for any domain. That is why browsers do not wait for proof of abuse: trust is revoked first and investigated afterwards.
Timeline
| Date | Event |
|---|---|
| 17 Oct 2026 | The keys of eight eMudhra intermediate CAs are found to be weak. Chrome blocks them via CRLSet the same day. |
| 19–20 Oct 2026 | Android, Apple, and Microsoft follow. |
| 20 Oct 2026 | Google announces that the emSign ECC Root CA – G3 root will be removed from the Chrome Root Store. Mozilla removes it as well. |
| 22 Oct 2026 | eMudhra says it is leaving the global TLS certificate business; about 30,000 certificates need replacing. |
| 27 Oct 2026 | The root removal takes effect on Chrome users' devices. |
The technical details and Google's response are described on the Google security blog. Google also said it is reviewing eMudhra's other roots, so the blocking may widen.
Impact on websites and apps
- Visitors see a "connection not secure" warning, and most leave immediately.
- Transactions and forms fail, because browsers refuse to send data to an untrusted site.
- Apps and API integrations stop: mobile apps, webhooks, and server-to-server services usually reject the connection without any visible warning.
- Email can be affected too if your mail server uses the same certificate.
How to check your certificates
- Open your website in a browser, click the padlock in the address bar, and open the certificate details.
- Look at Issued by. If it says eMudhra or emSign, your certificate is affected.
- Repeat for every subdomain (e.g.
shop.,api.,mail.) — subdomain certificates are often forgotten. - Order a replacement from another CA, install it, and test again in several browsers.
The broader lesson
Incidents like this are rare, but not the first of their kind. The Chrome Root Program rules keep tightening — including mandatory issuance automation for CAs from 2027. Website owners are safest when certificate renewal and replacement are already automated, so switching CA takes a single setting change.
FAQ
Are free certificates (Let's Encrypt) affected? No. Let's Encrypt is a separate CA and is not involved in this incident.
Are certificates from Resmi.ID affected? No. Certificates sold by Resmi.ID are not issued by eMudhra. If you need a replacement from another provider, see the options on the SSL page.
Sources
- Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates — Google — blog.google
- Check your certificates before October 27: Chrome is removing an eMudhra root — SSL.com — ssl.com
- Chrome Root Program Policy — Google — googlechrome.github.io
Written from the sources above as of 31 October 2026. Third-party policies and figures can change — check the original sources for the latest.
All news