Browsers stop trusting eMudhra certificates: check your site's chain

Browsers and operating systems are removing their trust in certificates from eMudhra, a certificate authority (CA), after private keys for eight of its intermediate CAs were found to be easy to recover. The first changes arrived in October. The next round lands on 16 November 2026, when Microsoft removes eMudhra's remaining roots from Windows, Edge and WebView2, and Chrome stops trusting new certificates from the last eMudhra root it still holds.

Most websites use certificates from other CAs and are not affected. If yours does come from eMudhra, it may stop working for some visitors, and the fix is to replace it.

What happened

According to Google, the Chrome Root Program received a report from a security researcher at 18:05 UTC on Saturday 17 October 2026. The private keys for eight eMudhra subordinate CA certificates had been "generated with insufficient randomness", so they could be recovered. Anyone holding those keys could have issued certificates that browsers trusting those CAs would accept for any website.

Microsoft says six of the eight keys were for TLS, the certificates websites use for HTTPS, and two were for code signing.

Google says no TLS certificates chaining to the affected intermediates were logged to Certificate Transparency before it blocked them. That means no forged certificates from them could have been used against clients that require Certificate Transparency, including Chrome.

What browsers have done so far

Chrome and Android. Chrome confirmed the report at 19:45 UTC the same day and pushed an update to its CRLSet, a list Chrome downloads in the background, blocking the affected intermediates. No browser update or restart was needed. Android devices received an equivalent update through Google Play Services from about 22:00 UTC on 19 October.

Google then removed the root that signed the compromised intermediates, emSign ECC Root CA - G3, from the Chrome Root Store. The removal was expected to reach all devices that rely on that store on 27 October. Google's post says plainly that "some legitimate certificates chaining to this root will cease to function in Chrome".

Windows and Edge. Microsoft added the affected CAs to the Windows Disallowed Certificate Trust List on 20 October and blocked the TLS certificates in Edge and WebView2 the same day. An out-of-band Windows update on 26 October removed seven related certificates from the Windows trust list, and Edge followed on 27 October. Those removals were also included in the 10 November Windows security update.

What changes on 16 November

Two separate changes are scheduled.

Chrome and emSign Root CA - G1. On 4 November, the Chrome Root Program said it will stop trusting new certificates from eMudhra's remaining root in its store, emSign Root CA - G1. TLS server certificates that chain to this root and whose earliest Signed Certificate Timestamp is after 23:59:59 UTC on 16 November 2026 will no longer be trusted by default in Chrome 153 and higher. Certificates issued before that cut-off are not affected by this change. Google says the change is timed to coincide with the Chrome 158 stable release on 17 November, and that the date may shift if new information comes to light. Its notice also says eMudhra has announced it is leaving the global SSL/TLS certificate business, and that Chrome is still reviewing the remaining eMudhra CAs.

Windows, Edge and WebView2. In an update to its post on 12 November, Microsoft said it will remove the remaining eMudhra roots, including emSign Root CA - G1, on 16 November. The removal reaches Windows through automatic trust updates, and Edge and WebView2 through their own component updates.

Because Microsoft's change removes the roots rather than limiting new certificates, a site whose certificate chains to any eMudhra root should not rely on it continuing to work in Edge or on Windows after 16 November.

What it means for your site

• Check who issued your certificate. In most browsers, click the icon to the left of the address bar and open the certificate details. The issuer and the root at the top of the chain are listed there. From a terminal, openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts </dev/null prints the chain, with each certificate's issuer on its i: line.
• If the chain ends in an eMudhra or emSign root, replace the certificate now. Google tells site operators affected by the G3 removal that they "must immediately acquire and install a new TLS certificate from another PKI hierarchy" included in the Chrome Root Store. Microsoft advises finding those dependencies and getting replacements before the changes reach your visitors' devices.
• Check more than the website. APIs, mail servers, admin panels and anything else that serves HTTPS on your domains each have their own certificate.
• Do not work around it. Microsoft advises against restoring trust in an affected hierarchy without understanding the risk.
• If your certificate comes from another CA, there is nothing to do. Keeping devices and browsers updating automatically is enough to receive these protections.

Sources

• Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates
• Chrome Root Program: Upcoming change for eMudhra CA certificates included in the Chrome Root Store (CCADB Public, 4 November 2026)
• Microsoft Security Response Center: Microsoft's response to compromised eMudhra certificate authority keys