Website operators have a hard deadline: Google will remove the emSign ECC Root CA - G3 from the Chrome Root Store on Tuesday morning, 27 October 2026, Pacific time, with prerelease channels such as Chrome Canary and Beta receiving it sooner. The step follows the discovery of weak cryptographic keys linked to eMudhra intermediate certificate authorities, and it will affect legitimate website certificates that chain to that root, not only the compromised intermediates.

How the problem began

A researcher reported the issue to Apple, Google, Microsoft, Mozilla and eMudhra on 17 October. Google and Mozilla moved quickly to block the affected intermediate certificate authorities. Google said its investigation found no certificates issued by the six affected TLS intermediates in Certificate Transparency logs before the block, which reduces evidence of abuse through those certificates, though it does not lessen the seriousness of the key-generation failure.

Why legitimate sites are caught up

A browser trusts a website certificate because it chains back to a root it recognises. Removing a root therefore breaks trust for every certificate under it, even ones issued through unrelated intermediates. Reports put unexpired certificates chained to the affected root at around 30,800 as of 21 October, about 99.9 percent issued through InCommon, a service used widely by universities. Automatic renewal alone may not replace them before the deadline unless systems are configured to act early.

What operators must do

Check your full certificate chain, and if it leads to emSign ECC Root CA - G3, immediately obtain and install a replacement certificate from another publicly trusted hierarchy in the Chrome Root Store. Do not wait for expiry. Google says eMudhra has committed to helping affected subscribers migrate, and it is closely investigating whether eMudhra's remaining certificates should stay in the Chrome Root Store.