# eMudhra intermediate CAs compromised and blocked by browsers

> Google, Mozilla and Apple blocked compromised eMudhra subordinate CAs in October 2026 and acted against the emSign ECC Root CA - G3 root.

Source: https://ssl.sh/news/emudhra-compromised-intermediate-cas/
Last updated: 2026-11-10

In October 2026 Google, Mozilla and Apple confirmed that several subordinate CA certificates of eMudhra, an India-based CA, had been compromised, and all three blocked them. They also acted against the emSign ECC Root CA - G3 root. Chrome will not trust new certificates under emSign Root CA - G1 issued after 16 November 2026.

## What happened

Chrome, Firefox and Apple platforms blocked the compromised [subordinate CAs](https://ssl.sh/glossary/subordinate-ca/) between 17 and 19 October 2026. The vendors count them differently: Google describes eight, while Mozilla and Apple describe six that issue TLS certificates plus two used for code signing.

| Date | Action |
|---|---|
| 2026-10-17 | Chrome pushes a CRLSet block for the affected CAs; Mozilla adds OneCRL entries |
| 2026-10-19 | Apple blocks the affected certificates |
| 2026-10-20 | Google publishes its post, later updated on 2026-11-04 |
| 2026-10-23 | Apple blocks emSign ECC Root CA - G3 |
| 2026-10-27 | Chrome's removal of emSign ECC Root CA - G3 reaches devices |
| 2026-11-16 23:59:59 UTC (upcoming) | Cutoff after which Chrome 153+ distrusts new certificates under emSign Root CA - G1 |

Mozilla's response also includes an NSS update that removes the root. CRLSets in Chrome and OneCRL in Firefox let browsers block intermediate certificates directly, without waiting for the CA's own [CRL](https://ssl.sh/glossary/crl/). The emSign Root CA - G1 step uses the [SCT](https://ssl.sh/glossary/sct/) timestamp from [Certificate Transparency](https://ssl.sh/glossary/certificate-transparency/) to decide when a certificate was issued, the same [distrust](https://ssl.sh/glossary/distrust/) method used against [Entrust](https://ssl.sh/news/entrust-distrust/) in 2024.

## Who is affected

Every website, API and app whose certificate chains to an [eMudhra](https://ssl.sh/cas/emudhra/) root is affected in one of three ways:

- **Certificates issued by a compromised subordinate CA** are already blocked. Visitors see errors such as [NET::ERR_CERT_REVOKED](https://ssl.sh/errors/net-err-cert-revoked/) or [NET::ERR_CERT_AUTHORITY_INVALID](https://ssl.sh/errors/net-err-cert-authority-invalid/).
- **Certificates under emSign ECC Root CA - G3** are no longer trusted in Chrome or on Apple platforms.
- **Certificates under emSign Root CA - G1** with an earliest SCT before the cutoff continue to work in Chrome for now; ones issued after it will not be trusted in Chrome 153 and later.

Mobile apps and API clients that use the operating system trust store follow the platform's decision, so test them separately from browsers.

## What you should do

Replace any certificate whose chain includes eMudhra or emSign. Check your chain first:

```bash
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null \
  | grep -iE 'emsign|emudhra'
```

If it prints anything, replace the certificate with one from another CA and deploy it before renewal is due. Search [Certificate Transparency logs](https://ssl.sh/tools/ct-search/) for every certificate issued for your domains, so that no forgotten host keeps serving an affected one. Publishing [CAA](https://ssl.sh/glossary/caa/) records that list only the CAs you actually use, built with the [CAA generator](https://ssl.sh/tools/caa-generator/), limits which CAs may issue for your domains in future. The [root program timeline](https://ssl.sh/timeline/root-program-changes/) tracks this and earlier distrust events.