eMudhra Is Leaving the SSL Business: What to Do Before 27 October

On 22 October 2026, eMudhra’s board decided to leave the global SSL/TLS certificate business, just five days after a researcher showed that the keys behind eight of its intermediate certificates could be recovered in under a second. Chrome is due to remove the emSign ECC Root CA – G3 root on the morning of 27 October, US Pacific time, which is roughly the evening of 27 October in India. If any of your certificates chain to that root, this post covers what has changed since the first reports and what to do in the next few days.

Key takeaways

eMudhra is withdrawing from global TLS certificates, so reissuing on its remaining RSA chain is at best a stopgap, not a destination.
Chrome counted about 30,800 unexpired certificates under the ECC root on 21 October. About 99.9% were issued through InCommon, and they are affected because of the root they chain to, not because they used the weak keys.
Auto-renewal will not rescue you: standard ACME clients do not replace a certificate before its renewal window unless they support ARI or you force it.
Browsers are not the only clients. Java, containers, proxies and embedded devices keep their own trust stores.

Five-step plan before 27 October: check your chain, inventory certificates, choose a new CA, force reissuance, verify the new chain — Browsers will not wait for your renewal schedule.

Table of Contents

What changed on 22 October

In its press release, eMudhra said its board voluntarily decided to withdraw from the global SSL/TLS certificate business. The company says that business is about 1% of its revenue, and it cites rising data-sovereignty and compliance costs and the spread of free certificates. It says it will replace affected customers’ certificates free of charge through partners (its later update mentions Sectigo as an option), and that its revocation and status services will keep running until every certificate it issued has expired or been replaced. Its digital signature, eSign and enterprise PKI products are not part of the exit. For the technical background on the weak keys, see our earlier explainer on the emSign certificate distrust.

Who is actually affected

Chrome’s count on 21 October was roughly 30,800 unexpired certificates chaining to the ECC root, and eMudhra estimates about 30,000 need to be moved. According to The Hacker News, almost all of them came through InCommon, a federation widely used by universities and research organisations, and they were not issued by the eight weak intermediates. They stop working in Chrome simply because the root above them is being removed. If your certificate came from a different hierarchy, this removal does not touch you.

Why the RSA chain is a bridge, not a destination

eMudhra says its G1 RSA roots stay active until the transition is complete, and Mozilla said it was not removing the G1 root. Some institutions initially pointed people to RSA certificates as the quick route. But analysts quoted by Computerworld describe G1 as a possible bridge at best, and the University of Michigan has warned that InCommon’s RSA certificates could also be distrusted later, which would mean doing the work twice. Chrome has also not decided whether to keep eMudhra’s remaining CA certificates in its root store, and it has posted a list of unanswered questions about how the company handled the issue. If you use G1 to avoid an outage this week, set a date to move to an independent CA.

What to do before 27 October

Check your chain. Run your site through our free emSign checker or look at the chain your server sends.
Inventory every certificate. Record the issuer, the full chain, where each one is deployed and who owns it. Public logs only show public websites, so internal, client and code-signing certificates need a separate check.
Pick a CA outside the eMudhra family for anything you intend to keep. Free ACME-based CAs are an option for many sites; regulated or high-assurance setups may need a paid CA.
Force new issuance. Change the CA your ACME client uses, register an account with it, and request a new certificate now. Check key type settings, because moving from an ECC to an RSA hierarchy can need client configuration changes.
Deploy and verify. Confirm the new certificate and chain are actually being served, the service reloaded, and the old certificate removed.

Why auto-renewal will not save you

About 97% of the affected certificates were issued through ACME, the protocol behind tools like certbot, acme.sh, Caddy and cert-manager. That makes the fix quick, but Chrome has pointed out that standard ACME clients do not replace a certificate outside its renewal window unless they support ACME Renewal Information (ARI) or someone replaces it manually. In other words, a certificate with two months left will keep serving the old chain until you step in.

Check the non-browser clients too

Java does not check revocation by default, and Azul has released OpenJDK builds that block the eight certificates, according to Computerworld.
The Go project released fixes on 20 October that reject chains containing the keys, and programs must be rebuilt to pick them up. Node.js and Linux distributions also published updates, as reported by The Hacker News.
Container images, proxies, load balancers, VPN appliances, mutual-TLS setups and embedded devices can carry their own trust stores. Start with the ones that accept outside connections.

The lesson: be able to switch CAs quickly

Chrome’s removal reaches users about ten days after the disclosure. When the Entrust distrust happened in 2024, customers had months. A certificate authority can leave before your certificates expire, so it helps to know how fast you could move. Encryption Consulting’s analysis suggests keeping a second CA account validated in advance, issuing a small share of certificates from it, and rehearsing a switch on non-critical systems. That is the author’s opinion rather than a rule, but it is a cheap way to test whether your automation really works.

This is general information, not advice for your specific environment. Check your certificate provider’s and browser vendors’ latest notices, since details are still changing.

Sources

Frequently asked questions

Do I need to act if my certificate is not from eMudhra?

No. The root removal only affects certificates that chain to emSign ECC Root CA – G3. Certificates from other hierarchies are not touched by it.

Can I just reissue on eMudhra’s RSA chain?

It can work as a short-term bridge, but eMudhra is leaving the global TLS business and trust in the remaining hierarchy is not guaranteed. Plan a move to an independent CA.

What happens on 27 October if I do nothing?

Chrome is expected to stop trusting the ECC root, so visitors may see security warnings for sites that still serve that chain. Firefox already removed the root on 20 October.