eMudhra intermediate CAs compromised and blocked by browsers

In October 2026 Google, Mozilla and Apple confirmed that several subordinate CA certificates of eMudhra, an India-based CA, had been compromised, and all three blocked them. They also acted against the emSign ECC Root CA - G3 root. Chrome will not trust new certificates under emSign Root CA - G1 issued after 16 November 2026.

What happened

Chrome, Firefox and Apple platforms blocked the compromised subordinate CAs between 17 and 19 October 2026. The vendors count them differently: Google describes eight, while Mozilla and Apple describe six that issue TLS certificates plus two used for code signing.

Mozilla's response also includes an NSS update that removes the root. CRLSets in Chrome and OneCRL in Firefox let browsers block intermediate certificates directly, without waiting for the CA's own CRL. The emSign Root CA - G1 step uses the SCT timestamp from Certificate Transparency to decide when a certificate was issued, the same distrust method used against Entrust in 2024.

Who is affected

Every website, API and app whose certificate chains to an eMudhra root is affected in one of three ways:

• Certificates issued by a compromised subordinate CA are already blocked. Visitors see errors such as NET::ERR_CERT_REVOKED or NET::ERR_CERT_AUTHORITY_INVALID.
• Certificates under emSign ECC Root CA - G3 are no longer trusted in Chrome or on Apple platforms.
• Certificates under emSign Root CA - G1 with an earliest SCT before the cutoff continue to work in Chrome for now; ones issued after it will not be trusted in Chrome 153 and later.

Mobile apps and API clients that use the operating system trust store follow the platform's decision, so test them separately from browsers.

What you should do

Replace any certificate whose chain includes eMudhra or emSign. Check your chain first:

echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null \
  | grep -iE 'emsign|emudhra'

If it prints anything, replace the certificate with one from another CA and deploy it before renewal is due. Search Certificate Transparency logs for every certificate issued for your domains, so that no forgotten host keeps serving an affected one. Publishing CAA records that list only the CAs you actually use, built with the CAA generator, limits which CAs may issue for your domains in future. The root program timeline tracks this and earlier distrust events.