emSign Certificate Distrust: What Changes on 16 November and What to Do
Chrome and Firefox stop trusting new emSign G1 certificates after 16 November 2026, and Apple ends G1 trust on 30 November. Here is how to check and replace yours.
Image: TeQBlogs
If your website, app or server uses an emSign certificate from eMudhra, check it now. Chrome and Firefox will not trust new TLS certificates from the emSign Root CA – G1 hierarchy issued after 16 November 2026, and Apple will stop trusting all G1-chained certificates on 30 November 2026. Certificates under the older emSign ECC Root CA – G3 are already distrusted.
This guide explains what happened, the exact dates, who is affected and how to check and replace your certificate.
Quick summary
- What happened: Eight eMudhra intermediate CA keys created on 30 April 2025 were found to be weak and recoverable. They were revoked on 18 October 2026.
- More revocations: eMudhra’s incident report says eight more RSA intermediates (G2B/G2C) were revoked on 7 November 2026 as a precaution.
- 16 November 2026: Chrome and Firefox stop trusting emSign G1 certificates issued after this date.
- 30 November 2026: Apple ends trust in all emSign G1-hierarchy certificates, according to eMudhra.
- Not affected: India’s digital signature (DSC) and eSign services, per eMudhra and CERT-In.
What happened to emSign certificates?
eMudhra, the Indian certificate authority behind the emSign brand, created eight intermediate CAs in a key generation ceremony on 30 April 2025. On 17 October 2026 an independent researcher reported that their private keys were weak: a flaw in one step of the ceremony produced keys that could be recalculated from the public certificates. Anyone holding such a key could, in theory, issue a fake certificate for any website.
Also read: November 2026 Patch Tuesday: Outlook Zero-Day Fixed, Update Now
eMudhra revoked all eight intermediates on 18 October 2026. Google pushed a block to Chrome within hours, Mozilla blocked them in Firefox, and Apple and Microsoft followed. eMudhra and Google both say no end-entity certificates were found from these intermediates in Certificate Transparency logs, and CERT-In found no confirmed malicious use as of 21 October 2026.
emSign certificate timeline and key dates
| Date | What happened |
|---|---|
| 30 April 2025 | Intermediate CAs created in the flawed key ceremony |
| 17 October 2026 | Weak keys reported; Chrome blocks the affected intermediates |
| 18 October 2026 | eMudhra revokes the eight ECDSA (G3B/G3C) intermediates |
| 21 October 2026 | CERT-In issues advisory CIAD-2026-0050 |
| 27 October 2026 | Chrome removes emSign ECC Root CA – G3 (expected to reach devices) |
| 7 November 2026 | Eight RSA (G2B/G2C) intermediates revoked, per eMudhra’s incident report |
| 16 November 2026 | Chrome and Firefox stop trusting new emSign G1 certificates |
| 30 November 2026 | Apple ends trust in all emSign G1 certificates (per eMudhra) |
Google’s 4 November update is precise: in Chrome 153 and later, TLS server certificates that chain to emSign Root CA – G1 and whose earliest Signed Certificate Timestamp (SCT) is after 16 November 2026, 11:59:59 PM UTC will not be trusted by default. Certificates logged on or before that time keep working in Chrome. Microsoft is also reportedly removing the remaining eMudhra roots from Windows and Edge from mid-November; its October post said it was evaluating those roots separately.
Who is affected in India?
eMudhra says the weak-key problem directly affected TLS certificates under the distrusted ECC root, mainly one US customer group of about 30,800 certificates. It has also decided to wind down its publicly trusted TLS business and says emSign TLS customers in all regions except the US have been moved to other providers.
- Likely affected: websites, APIs, mail servers and apps still using an emSign TLS (SSL) certificate, especially one chaining to emSign ECC Root CA – G3 or emSign Root CA – G1.
- Possibly affected: software signed with emSign code-signing certificates, and older systems or apps that carry their own certificate list.
- Not affected: Digital Signature Certificates used for GST, income tax or MCA filings, and eSign services, which eMudhra and CERT-In say run on separate infrastructure.
How to check if your site uses an emSign certificate
It takes about two minutes per domain.
- Open your website in Chrome on a computer.
- Click the site-information icon to the left of the address, then Connection is secure → Certificate is valid.
- Open the Details tab and look at the certificate hierarchy.
- If any level shows emSign or an “EM … TLS CA” issuer name, the certificate belongs to eMudhra’s hierarchy.
- Note the expiry date and which root it chains to (G3 or G1).
- Repeat for subdomains, API endpoints and mail servers, not only the main website.
Administrators can also run openssl s_client -connect yourdomain.com:443 -showcerts and read the issuer lines, or search the domain in a Certificate Transparency log viewer to find every certificate issued for it.
How to replace an emSign certificate
Google’s guidance for G3 users is direct: get a new TLS certificate from another hierarchy that is in the Chrome Root Store. For G1 users, replacing before the deadlines avoids surprises, especially with Apple devices from 30 November.
- Contact your certificate reseller, hosting provider or eMudhra support. eMudhra says it offers Sectigo-issued replacements, through the CertiNext account for existing CertiNext users.
- Alternatively, issue a certificate from another trusted CA, such as a free automated certificate from your host’s AutoSSL or Let’s Encrypt.
- Install the new certificate with its full chain on every server and load balancer.
- Test in Chrome, Firefox and Safari, and on an iPhone or Mac, before the old certificate is removed.
- If you use automatic renewal (ACME), confirm the client now points to the new CA.
Businesses that rely on many certificates should keep an inventory with issuer and expiry date. Our guide on AI agent security for businesses covers related monitoring basics, and Suprams’ cybersecurity team can help audit certificates across servers.
What users and developers should update
Ordinary users only need to keep devices and browsers updated; Chrome, Android, Firefox, Safari and Windows received the blocks automatically. Mac users should install macOS 27.2.1, 26.7.3 or 15.8.3, which Apple says remove the affected roots from the system file used by command-line tools such as curl and git.
Developers should update runtimes and CA bundles that keep their own certificate lists, as CERT-In recommends: language runtimes, the Python certifi package, container base images, appliances and embedded systems. Never “fix” a certificate error by turning off verification. Keep browsers current too; our coverage of the latest Chrome zero-day shows why.
Frequently asked questions
Will my emSign certificate stop working on 16 November?
Not automatically in Chrome and Firefox if it was issued and logged before 16 November 2026. Apple devices, however, stop trusting all G1 certificates on 30 November, according to eMudhra, so plan a replacement.
Is my Digital Signature Certificate (DSC) from eMudhra affected?
No. eMudhra and CERT-In say India’s DSC and eSign services are not affected, because they run on separate infrastructure.
Were any websites attacked using the weak keys?
No confirmed misuse has been reported. Google found no certificates from the affected intermediates in Certificate Transparency logs before its block, and CERT-In found no confirmed exploitation.
Where can I get a replacement certificate?
eMudhra says it offers Sectigo-issued replacements through CertiNext or its support team. You can also use any other publicly trusted CA, including free automated certificates from your hosting provider.
Bottom line
The emSign certificate problem is now mostly a deadline problem. If any of your domains or apps use an emSign TLS certificate, check the chain today and move to another trusted CA before 16 November, and certainly before Apple’s 30 November cut-off. Everyone else should simply keep browsers, operating systems and developer tools updated.
Sources
- eMudhra: Certificate security incident statement
- CERT-In advisory CIAD-2026-0050
- Google: Protecting Chrome and Android users from compromised eMudhra intermediate CA certificates
- Apple: About the compromised eMudhra certificates
About The Author
