# emSign ECC Root CA - G3 root certificate (eMudhra)

> emSign ECC Root CA - G3 is a root CA certificate operated by eMudhra (ECDSA P-384, valid until 2043-02-18, SHA-256 86A1ECBA). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

Source: https://ssl.sh/roots/emudhra-emsign-ecc-root-ca-g3/
Last updated: 2026-11-10

emSign ECC Root CA - G3 is a root CA certificate operated by eMudhra (ECDSA P-384, valid until 2043-02-18, SHA-256 86A1ECBA). As of the latest CCADB data it is trusted for TLS server authentication by 2 of 4 major root stores: Apple, Microsoft.

| Field | Value |
|---|---|
| CA owner | eMudhra |
| Subject | CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN |
| SHA-256 | 86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B |
| SPKI SHA-256 | 8D417DB2DD8BF5E3084D1E3F196D583849D81BDD4C00C70B9D39369E96B8C782 |
| Valid from | 2018-02-18 |
| Expires | 2043-02-18 |
| Key | ECDSA P-384 |
| Signature algorithm | ecdsa-with-SHA384 |
| Serial number | 3CF607A968700EDA8B84 |
| SHA-1 (Windows thumbprint) | 3043FA4FF257DCA0C380EE2E58EA78B23FE6BBC1 |

## Root store status

| Root store | Status | Trusted for TLS | Distrust for TLS after | Details |
|---|---|---|---|---|
| Chrome | Blocked | No | - | - |
| Mozilla | Removed | No | - | - |
| Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection |
| Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Code Signing, Document Signing, Secure Email, Time Stamping |

The CCADB lists EV policy OID 2.23.140.1.1, 2.23.140.1.3 for this root, but Mozilla does not mark it as EV-enabled.

## Intermediate CAs issued by this root

The CCADB lists 15 intermediate CA certificates signed directly by emSign ECC Root CA - G3: 3 currently valid, 0 expired and 12 revoked (revoked includes those whose parent was revoked).

| Intermediate | Operated by | Expires | Status | SHA-256 |
|---|---|---|---|---|
| emSign Root TLS CA - G3 | eMudhra Technologies Limited | 2039-07-09 | Valid | 3094025792039A68AF6E553686410BDAB7C0D4A36B9084CBA64202E35D6EBBDD |
| emSign ECC SSL CA - G3 | eMudhra Technologies Limited | 2033-02-18 | Valid | 6B51D1DCF4EB7AEE424185CB1B9580574B39CB963863DE3EC1AD31DDB076CE9F |
| emSign ECC EV SSL CA - G3 | eMudhra Technologies Limited | 2033-02-18 | Valid | 0116F17F97CDEF4ADE2E63CF2C1B064FD99F404D2B914100BC241F0781853323 |
| emSign Root SMIME CA - G3 | eMudhra Technologies Limited | 2039-07-09 | Revoked | B4CEEBA48EF8CCC6090F6D2A62A85DBB51C5A106A7DC7EC5408270020F91C222 |
| emSign Root TSA CA - G3 | eMudhra Technologies Limited | 2039-07-09 | Revoked | 873BE6F9EF3057221928E840686E2D18211A2680AE07051148C11A29D41BA98F |
| emSign Root CS CA - G3 | eMudhra Technologies Limited | 2039-07-09 | Revoked | 7137FA71AD46BA686F746D1014AC57E8E6C6E9AF4AA2F73C0C44A5CF27DEBB59 |
| emSign Root Client Auth CA - G3 | eMudhra Technologies Limited | 2039-07-09 | Revoked | 63088538028E233C61B54C5A4238B7C753C04F32362F1C95A428D28E9CB6B15E |
| emSign ECC SMIME CA - G3 | eMudhra Technologies Limited | 2038-08-22 | Revoked | F5B3E914CDE2954F65464FA8E9D69F0492622B3C2AC243987B11CBBF1B451307 |
| emSign ECC Time stamping CA - G3 | eMudhra Technologies Limited | 2033-02-18 | Revoked | C422AB86C1729E889FBCAF5CD73F217E03C29FE2AC50212F451307D915869F47 |
| emSign ECC Class 1 CA - G3 | eMudhra Technologies Limited | 2033-02-18 | Revoked | ABA6A65DCE8955BAF0685AB88809B7699C174496EF9EE991533251494F43CE10 |
| emSign ECC Device CA - G3 | eMudhra Technologies Limited | 2033-02-18 | Revoked | 70B9BA595412CF8614B76747FD683CCA2759F42642164834FBEFDD88505C4F1C |
| emSign ECC Class 3 CA - G3 | eMudhra Technologies Limited | 2033-02-18 | Revoked | 7066A0F42F530E0DB5AFEE72A3B04DE614E7D2305C67D12C756BB215E37CB975 |
| emSign ECC Class 2 CA - G3 | eMudhra Technologies Limited | 2033-02-18 | Revoked | 4E9B731567177E1776A96D66D9120B3DEB28B800937EA4662565B3EF5EC8000B |
| emSign ECC CS CA - G3 | eMudhra Technologies Limited | 2033-02-18 | Revoked | 0D6869A2B4F5DF77A6AFB034225E9BEF345743CF306EDF36EE35B9D05AFAD89C |
| emSign ECC EV CS CA - G3 | eMudhra Technologies Limited | 2033-02-18 | Revoked | 0BADA979B71402FE860696032CF40E9D2A3F41CCB5D03BE33FBB94A80D7FFC7C |

## Cross-signed versions

No certificate in the CCADB has the same subject and public key as emSign ECC Root CA - G3 with a different issuer, so a client has to carry emSign ECC Root CA - G3 itself in its root store to trust it.


## What happens when it expires

emSign ECC Root CA - G3 is valid until 2043-02-18, about 16.3 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors.

## FAQ

**Is emSign ECC Root CA - G3 trusted by Chrome, Firefox, Safari and Windows?**

As of 2026-11-10, Apple, Microsoft trust it for TLS server authentication; Chrome, Mozilla do not.

**When does emSign ECC Root CA - G3 expire?**

On 2043-02-18, about 16.3 years after the 2026-11-10 data snapshot.

**How many intermediate certificates has emSign ECC Root CA - G3 issued?**

The CCADB lists 15: 3 valid, 0 expired and 12 revoked. The newest valid one is emSign Root TLS CA - G3, valid until 2039-07-09.

**Is emSign ECC Root CA - G3 cross-signed?**

No. The CCADB has no certificate with the same subject and public key signed by another CA.

Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).