eMudhra's TLS exit puts the G3 certificate chain ahead of expiry dates

A website using a certificate that chains to emSign ECC Root CA - G3 may need a replacement before that certificate expires. Google expects its root-store removal to reach devices relying on the Chrome Root Store on the morning of October 27, 2026, Pacific time. eMudhra's decision to leave the global TLS business creates a broader transition, but the two scopes should not be confused.

The company's October 22 announcement records the board's withdrawal decision. Its incident statement, updated October 26, says migration work is underway and a full root-cause analysis will follow. Google's separate October 20 security advisory establishes the browser trust change and the action required for affected sites.

One hierarchy has the immediate deadline

Google says eight subordinate CA certificates had private keys generated with insufficient randomness. It blocked the affected intermediate keys, then removed the emSign ECC Root CA - G3 root to protect consumers of its root store that do not receive the same blocking updates.

That wider root removal can also affect legitimate certificates. Google tells operators whose certificates chain to it to acquire and install a replacement from another hierarchy included in the Chrome Root Store. October 27 is the expected distribution timing, with earlier delivery on prerelease channels; it is not a promise that every client changes simultaneously.

A certificate's expiry date answers how long it was issued for. Browser trust answers whether that client accepts its chain. An unexpired certificate can therefore still fail after a trust-store change.

The business exit needs a separate migration plan

eMudhra says its G1 RSA roots will continue serving customers through the transition, and revocation and certificate-status services will remain until issued certificates expire or are replaced. It is offering partner-issued replacements without charge. Those are the company's commitments, rather than proof that a particular customer has completed migration.

Operators should establish which chain their live service presents and where TLS terminates, including a hosted platform or load balancer. Ask the provider which replacement hierarchy will be served, install through the normal controlled process, and verify the resulting service from the clients that matter. Receiving a replacement file is not the same as deploying it successfully.

For customers outside the affected G3 hierarchy, the exit still warrants a renewal and support plan. It does not establish that all eMudhra certificates stop working on October 27.

Keep the incident findings within their evidence

In its October 26 update, eMudhra attributes the weak keys to a script error and says its investigation has found no compromise of infrastructure or customer data. It says its digital-signature, eSign and enterprise applications use separate infrastructure and were not affected.

Those are attributed company findings while the investigation continues. A promised independent review and root-cause report are still future evidence. For readers, the practical distinction is between protecting browser users, replacing an affected served chain, and establishing the final cause; progress on one does not complete the others.

Sources

• eMudhra: October 22 global SSL/TLS withdrawal announcement

• Google Chrome and Android Security: October 20 advisory

• eMudhra: incident statement, updated October 26