Chrome Removes the emSign Root Certificate: Google Said Oct 27 for All Devices

What happened

The incident began with a weak-key finding in mid-October: researchers reported that the private keys of eight intermediate certificate authorities of Indian certificate authority eMudhra were recoverable because they were generated with insufficient randomness. Chrome and Firefox blocked the affected intermediates on Oct 17, and Mozilla removed the root from its trust store on Oct 20; Google then announced a further step: removing emSign ECC Root CA - G3, the root that signed those eight intermediates, from the Chrome Root Store, saying the move serves consumers of the Chrome Root Store that do not consume CRLSet updates, while the Oct 17 block already protects Chrome users.

The scale comes from Google's counts: on Oct 21, about 30,800 unexpired precertificates chained to that root, 99.9% of them issued by InCommon intermediates OVG3C or DVG3C; Google said no certificates chaining to the affected intermediates appeared in Certificate Transparency logs, and eMudhra said it found no evidence the weak keys were exploited before disclosure. eMudhra announced on Oct 22 that it is exiting the global SSL/TLS certificate business, with its G1 roots continuing to serve during the transition and Sectigo-issued replacement certificates offered to customers, and revocation and certificate-status services running until every issued certificate has expired or been replaced.

The remaining exposure sits outside browsers: runtimes, language toolchains and container images carrying their own certificate bundles update on different schedules from browsers. Node.js security releases on Oct 21 covered the incident, certifi 2026.10.19 no longer includes the root, pip 26.2.2 ships that certifi release, and uv 0.13.4 and 0.13.5 also removed the root; a scan on Oct 24 reported that 10 of 30 common container images still trusted the root, two of them built three days after the NSS fix. Google said in its announcement that some legitimate certificates chaining to the root will cease to function in Chrome as a result of the removal.

Key facts

1. Removed root: emSign ECC Root CA - G3, the root that signed the eight weak-key intermediates; Google said the removal was expected to reach all devices relying on the Chrome Root Store on the morning of Oct 27 Pacific time.
2. Chain of events: Chrome and Firefox blocked the affected intermediates on Oct 17; Mozilla removed the root from its trust store on Oct 20; Oct 27 was the Chrome Root Store removal date.
3. Scale: Google counted about 30,800 unexpired precertificates under that root on Oct 21, 99.9% issued by InCommon intermediates OVG3C or DVG3C.
4. Exploitation evidence: Google said no certificates chaining to the affected intermediates appeared in Certificate Transparency logs; eMudhra said it found no evidence the weak keys were exploited before disclosure.
5. Vendor exit: eMudhra announced on Oct 22 that it is exiting the global SSL/TLS certificate business, with G1 roots continuing to serve during the transition and Sectigo-issued replacement certificates offered.
6. Updates beyond browsers: Node.js Oct 21 security releases, certifi 2026.10.19, pip 26.2.2 and uv 0.13.4 and 0.13.5 have removed the root; an Oct 24 scan reported 10 of 30 common container images still trusted the root.