Why Chrome Is Removing a Root Certificate on 27 October After an eMudhra Key Report
Chrome and Firefox blocked a compromised certificate authority within hours. Chrome's root removal, due 27 October, shows how browsers set the rules for the web.
A browser decides which certificate authorities a website can use to prove its identity. Chrome and Firefox each keep a list of trusted roots, and when a root leaves that list, some legitimate certificates that chain to it stop working in that browser. On 17 October 2026, a researcher reported that the private keys of eight eMudhra intermediate certificate authorities could be computed from the public certificates. Google says Chrome had blocked the affected keys within two hours.
Browser makers can block a certificate authority in hours, but the root removal is due to take effect ten days after the report. Google's removal of one root certificate, due to reach Chrome devices on 27 October, will stop some legitimate certificates working in Chrome. The sections below cover how the blocks were applied, why a root removal followed, what it means for sites that use these certificates, and how the case compares with the 2024 distrust of Entrust.
Two Kinds of Block, and Why Browsers Use Both
Browser makers keep their own lists of trusted roots: the Chrome Root Store and Mozilla's root store. Google runs the Chrome Root Program, which decides what goes on its list. Chrome also keeps a list of blocked keys, the CRLSet, which it can push to devices without a browser update. Mozilla's OneCRL does the same job for Firefox.
The two tools reach different places. A key block stops the specific intermediate certificates that were compromised, and it can take effect within hours. A root removal stops every legitimate certificate that chains to that root, and it takes effect when the browser's root store updates. Google said it used both here, because a removal also protects clients that do not consume CRLSet updates.
What Chrome and Firefox Blocked Between 17 and 20 October
Google says the Chrome Root Program received the report at 18:05 UTC on 17 October, and that a CRLSet block covering the affected intermediate keys was in place by 19:45 UTC. Google said the keys had too little randomness, which would let anyone forge trusted certificates for any website against clients that still trusted these authorities. Chrome users did not need a browser update or restart.
Mozilla says it received the report at 20:06 UTC on 17 October, and that its OneCRL block had reached standard Firefox installations by 22:59 UTC the same day.
Google says Android devices received an equivalent block through Google Play Services at about 22:00 UTC on 19 October. Mozilla then released Firefox 158.0.1 and Firefox ESR 115.43.1 and 153.5.1 for a minority of users whose custom settings may have kept them from receiving the OneCRL update. It also released NSS 3.131.1, which removes the signing root from the trust list that other applications use. The Hacker News reports that Apple also blocked the certificates on 19 October.
Why Chrome Is Removing the Root on 27 October
The removal targets emSign ECC Root CA - G3, which signed the six TLS intermediates in the affected set, according to The Hacker News. Google expects the removal to reach all devices that rely on the Chrome Root Store on 27 October, Pacific time. Chrome Canary and Beta are expected to receive it sooner.
The change has a cost that Google spelled out. Some legitimate certificates that chain to the root will stop working in Chrome. Google told website operators to acquire and install a new TLS certificate from another hierarchy in the Chrome Root Store right away, to avoid breakage. Google says eMudhra has committed to helping affected subscribers migrate.
Other software keeps its own copy of the root list. The Hacker News lists updates from certifi, webpki-roots and Homebrew's ca-certificates that also remove the affected roots, and says they can break legitimate certificates that chain to them.
What Sites Chaining to the Removed Root Face
The affected set includes intermediates under eMudhra's US name. According to The Hacker News, EM DV TLS CA - G3C is issued by eMudhra Inc in the US, and the Netherlands entity issues a G3B version. Both sit under the emSign root that Chrome is removing, so a certificate that chains through either one is exposed to the 27 October removal.
Google said no TLS certificates chaining to the six TLS intermediates had reached Certificate Transparency logs before the block. The Hacker News reports that eMudhra said only one of the eight intermediates had been deployed, and none had issued end-entity certificates. The company says it is issuing replacement certificates to customers.
According to The Hacker News, Sectigo also cross-signed each of the eight intermediates under its AAA Certificate Services root. The Hacker News reports that Chrome and Firefox no longer trust that root for websites, so those copies did not widen exposure in either browser.
The 2024 Entrust Distrust as a Point of Comparison
Google and Mozilla announced their Entrust decisions on 27 June 2024, according to ppc.land. Chrome said it would stop trusting TLS server authentication certificates whose earliest Signed Certificate Timestamp was dated after 11 November 2024, starting in Chrome 131. Mozilla said it would set a distrust-after date of 30 November 2024 for TLS certificates issued after that date. The decisions covered nine affected Entrust root certificates.
Google's stated reason was a 'pattern of compliance failures' over six years, ppc.land reports. Mozilla said Entrust's plan for addressing recent incidents was insufficient to restore trust. Entrust's response included a partnership with SSL.com as its external registration authority.
The eMudhra response runs on a different clock. The Entrust cutoffs were tied to dates in certificate records, so they set a point after which new certificates would not be trusted. The eMudhra block is tied to the compromised intermediate keys themselves, and its root removal follows about ten days after the first report.
What Remains Open After 20 October
Google said it reviewed its root store and found no other keys with the same weak-entropy failure. The Hacker News reports that Mozilla does not believe other certificate authorities are affected for now.
Several questions are still open. The Chrome Root Program is deciding whether eMudhra's remaining CA certificates should stay in its store, and Google says it will share updates in public forums, such as the CCADB public list. The Hacker News also reports that Chrome is reviewing emSign Root CA - G1. Mozilla says it will share more information as circumstances allow.
The cause is not settled. The Hacker News reports that eMudhra attributes the weak keys to a flaw in an April 2025 key ceremony that used FIPS 140-2 Level 3 hardware security modules. Whether anyone exploited the flaw is unknown.
