eMudhra Certificate Compromise: What Chrome Users and Website Owners Need to Check

• Google said private keys linked to eight eMudhra intermediate certificate authorities were compromised because of weak cryptographic key generation.
• Chrome blocked the affected intermediate keys and removed emSign ECC Root CA – G3 from the Chrome Root Store, which can break some legitimate TLS certificates.
• Website owners should inspect their certificate chain immediately and replace certificates that depend on the affected G3 root; ordinary Chrome users generally do not need to take action.

What happened with the eMudhra certificates?

Google reported on October 20, 2026, that private keys associated with eight eMudhra subordinate certificate authorities had been compromised. The keys were generated with insufficient randomness, meaning an attacker could potentially recover them and create trusted HTTPS certificates for other websites.

Chrome responded quickly by blocking the affected intermediate certificate keys through a CRLSet update. Google said this protection did not require a browser update or restart. The Android protection was distributed through Google Play Services, and Google said users could restart their devices to trigger an immediate update if needed.

There is an important distinction here: the incident involved eight intermediate certificate authorities, not eMudhra’s root private key. eMudhra said the affected intermediates had not issued publicly trusted end-entity certificates. The larger operational concern comes from Google’s separate decision to remove emSign ECC Root CA – G3 from the Chrome Root Store.

Why the Chrome Root Store change matters

A root certificate is one of the trust anchors Chrome uses to decide whether a website’s HTTPS certificate is legitimate. When Chrome no longer trusts a root, certificates that depend on that root can begin producing certificate errors even if their expiration date has not passed.

Google said the G3 root removal was expected to reach devices relying on the Chrome Root Store on October 27, 2026, with the change appearing sooner in Chrome Canary and Chrome Beta. Chrome’s component updater can deliver root-store changes separately from a full browser release.

This does not mean every eMudhra certificate is broken. The impact depends on the complete certificate chain. Certificates issued under other eMudhra hierarchies, including unaffected G1 paths, may continue to work, although eMudhra has said it is transitioning TLS customers to alternate providers and winding down publicly trusted TLS issuance.

Who needs to take action?

How website owners can check a certificate chain

Start with an inventory of public-facing domains, APIs, load balancers, reverse proxies, VPN portals, and customer-facing applications. Do not check only the main website; an old certificate on a less-visible subdomain can still cause an outage.

1. Open the site in Chrome and select the site information icon beside the address.
2. Open the certificate information or connection details and review the certificate chain.
3. Look for emSign ECC Root CA – G3 in the chain or trust path.
4. Record the leaf certificate, issuing intermediate, expiration date, renewal owner, and deployment location.
5. Repeat the check from more than one environment, including a normal workstation, a server, and any CDN or proxy that terminates TLS.

Chrome also provides certificate-management and diagnostic pages for administrators. The exact labels can vary by operating system and Chrome version, so treat the browser result as one part of the inventory rather than the only test.

For automated checks

Administrators can inspect a server’s presented chain with standard TLS tooling. For example:

openssl s_client -connect example.com:443 -servername example.com -showcerts

Review the issuer and subject fields for each certificate returned. A successful connection from one machine does not prove that every client will trust the chain, particularly when a browser or operating system has received a new root-store update.

What to do if the G3 root appears in your chain

1. Contact the certificate issuer or hosting provider. Ask for a replacement certificate from a different publicly trusted PKI hierarchy.
2. Confirm the replacement chain before deployment. Make sure the new chain does not rely on emSign ECC Root CA – G3.
3. Install the complete chain correctly. A replacement leaf certificate can still fail if the required intermediate certificate is missing or incorrectly ordered.
4. Test all termination points. Check the origin server, load balancers, CDN, WAF, reverse proxy, mail gateway, and disaster-recovery environment.
5. Monitor after the change. Watch certificate errors, synthetic checks, application logs, and customer reports from Chrome on desktop and Android.

eMudhra said it is offering alternate certificates and has been moving customers to other providers at no additional charge. Its October 28 update also said roughly 30,800 certificates in the affected G3 customer ecosystem belonged to a United States client environment. Those figures and transition details may change as the investigation continues, so affected customers should rely on their provider’s current written instructions.

What Chrome users should know

For most people browsing the web, this is a browser-side trust update rather than an account-security incident. Google said Chrome blocked the affected intermediate keys, and eMudhra said it had no evidence that customer data or its broader infrastructure had been compromised.

Still, do not bypass a Chrome warning if a website suddenly shows “Your connection is not private.” The warning may indicate that the site’s certificate chain is no longer trusted, and proceeding manually can expose you to an impersonation or interception risk. Contact the website operator through a known channel instead.

Android users should keep Google Play Services and the operating system current. A restart may cause pending security component updates to apply, but it is not a substitute for the website operator replacing an affected certificate.

What happens next?

Google said it is continuing to review eMudhra’s remaining certificate authorities and will publish further information through public Chrome Root Program and industry channels. eMudhra said it plans to publish a root-cause analysis through the Common CA Database process and has appointed KPMG as an independent external reviewer.

The practical deadline for website owners is not a future renewal date. If a production certificate chains to emSign ECC Root CA – G3, replacement and validation should be treated as an immediate maintenance task because Chrome’s root-store change has already begun rolling out.

Helpful Links

• Google Chrome Security: Compromised eMudhra Intermediate CA Certificates – Read Google's incident timeline, Chrome mitigation details, and explanation of the emSign ECC Root CA – G3 removal.
• eMudhra Statement on Recent Certificate Security Incident – Review eMudhra's customer-impact updates, certificate transition information, and latest investigation status.
• Chrome Root Store – Inspect the current Chrome Root Store data and verify trusted root certificate entries.
• Chrome CRLSets Documentation – Learn how Chrome distributes emergency certificate-blocking updates and how administrators can inspect CRLSet status.
• Google Chrome Help: Check if a Site's Connection Is Secure – Review Chrome's official guidance for certificate warnings, connection security, and device certificate management.
• Check if a site's connection is secure – Official page referenced in the article.

Frequently Asked Questions

Q. Does this mean every eMudhra certificate is unsafe?

A. No. The incident involved eight compromised intermediate certificate authorities, while the Chrome trust change specifically affects certificates chaining to emSign ECC Root CA – G3. eMudhra says most of its TLS certificates and its digital-signature and eSign services are unaffected, but each certificate chain must be checked individually.

Q. Do Chrome users need to delete or install a certificate?

A. No. Ordinary users should not manually install or delete certificates because that can weaken device security. Keep Chrome, Android, and Google Play Services updated, and contact a website operator if a trusted site suddenly shows a certificate warning.

Q. Can a certificate still work today even if it uses the affected G3 root?

A. Possibly, depending on the browser version, device, trust-store update, and certificate path. That temporary success should not be treated as proof that the certificate is safe to keep in production. Website owners should replace affected certificates and test the new chain across their supported environments.

Q. Were fraudulent website certificates issued using the compromised keys?

A. Google said no certificates chaining to six of the affected intermediate CAs had been logged in Certificate Transparency before Chrome blocked them. eMudhra said the affected intermediates had not issued publicly trusted end-entity certificates. The investigation remains ongoing, so those statements should not be expanded beyond the confirmed scope.

Q. What should I ask my certificate provider?

A. Ask whether your certificate chain includes emSign ECC Root CA – G3, whether a replacement certificate is required, which root and intermediate certificates will be used instead, when the replacement will be deployed, and whether the provider has tested the new chain in current Chrome desktop and Android environments.