Fix guides / Security notices

Security notice

Is your site's padlock from eMudhra? Chrome stops trusting it October 27.

Last updated: Thursday, October 22, 2026, 7:47 PM ETStatus: Browsers have blocked the weak certificates. Deadline for affected sites: October 27.

On October 17, 2026, a security researcher reported that eight certificates belonging to eMudhra, a company that issues the padlock (HTTPS) certificates websites use, had weak private keys. Google says the weakness let anyone forge trusted HTTPS certificates for any website. Chrome, Firefox and other browsers blocked those certificates within days. Google is now removing the eMudhra root they chain to, emSign ECC Root CA - G3, from Chrome, expected Tuesday morning, October 27, 2026 (Pacific time). Any website whose certificate chains to that root will show a security warning in Chrome after that. Most small business sites use other certificate providers and are not affected, but it takes one minute to check, and if yours is affected you need a new certificate before October 27.

Update, October 22, 2026

eMudhra is leaving the website certificate business. If your padlock chains to its emSign ECC Root CA - G3 root, you have until Tuesday morning, October 27, to replace it. Do not wait for eMudhra to contact you.

  • eMudhra is exiting. eMudhra says its board has decided to voluntarily withdraw from the global SSL/TLS certificate business. It says it will reach out to affected customers and replace their certificates free of cost through partners, that its G1 RSA roots will keep serving customers until the move is complete, and that its revocation and certificate status services will keep running until every certificate it issued has expired or been replaced. The Hacker News notes the announcement does not name the partners or give a date for the exit. (eMudhra, The Hacker News)
  • eMudhra's own account. eMudhra says no end entity certificates were issued from the affected certificate authorities, that its infrastructure was not compromised and that no data was breached. These are eMudhra's own statements. (eMudhra)
  • Chrome's deadline has not moved. Google says removing emSign ECC Root CA - G3 is expected for all devices on Tuesday morning, October 27, 2026 (Pacific time), and sooner in the Chrome Canary and Chrome Beta test versions. Google says website operators with certificates chaining to that root "must immediately acquire and install a new TLS certificate from another PKI hierarchy included in the Chrome Root Store." (Google)
  • Firefox is following. The Hacker News reports that Mozilla decided on October 20 to stop trusting the same root in Firefox. (The Hacker News)
  • Who has these certificates. The Hacker News reports that, by Chrome's count of public certificate logs, about 30,800 unexpired certificates chained to that root as of October 21, and that 99.9% of them were issued through InCommon, the certificate service Internet2 created for higher education. If your certificate came through InCommon or straight from eMudhra, check it today. (The Hacker News)
  • Automatic renewal may not fix it in time. The Hacker News reports that Chrome told eMudhra that standard ACME clients, the tools many servers use to renew certificates automatically, do not replace a certificate before its normal renewal window unless they support ACME Renewal Information (ARI) or someone steps in by hand. Ask whoever manages your certificate to replace it now, not at renewal time. (The Hacker News)

What to do: Use the one minute check further down this page: click the icon to the left of your web address in Chrome, open the certificate and look at the full chain. Or ask your host or agency which company issued your certificate and which root it chains to. If you see emSign ECC Root CA - G3, get a new certificate from another provider and install it before October 27. EverThread does not check for eMudhra or for this root, so do not wait for a warning from us.

What happened

Who should worry

If your certificate is from Let's Encrypt, Sectigo, DigiCert, Google, Cloudflare or another provider, your site's padlock is not affected by the October 27 change.

What to do now

  1. Check who issued your certificate (steps below). It takes one minute.
  2. If it chains to emSign ECC Root CA - G3, get a new certificate from another provider and install it before October 27. eMudhra says it is offering Sectigo certificates to its customers as an alternative. (Google, eMudhra)
  3. If you or your agency run your own server, ask them to update the server's certificate list and any copies bundled inside your site's code. (Sansec, Ubuntu)

How to check who issued your certificate

  1. Open your website in Chrome.
  2. Click the icon to the left of the web address, then "Connection is secure", then "Certificate is valid".
  3. Look under "Issued By" for the company name, and open the "Details" tab to see the full chain up to the root.
  4. If you see eMudhra or emSign anywhere in the chain, contact whoever manages your certificate today. If you see another company, the October 27 change does not affect your padlock.

In Firefox, click the padlock, then "Connection secure", then "More information", then "View Certificate".

What to send your developer, agency or host

Google is removing emSign ECC Root CA - G3 from the Chrome Root Store, expected Tuesday morning, October 27, 2026 PDT, after eight eMudhra intermediate certificates were found to have weak private keys. Please confirm whether any certificate on our sites chains to that root, and if so, replace it before October 27 with a certificate from another trusted provider. Please also update the CA certificate store on our servers (for example the ca-certificates package) and any CA bundle shipped inside our site or store code, so server side HTTPS calls to payment and other services no longer trust this root. Sources: Google, Mozilla, Sansec.

Technical steps

Step 1. Check the live chain

echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null | grep -E 's:|i:'

Look for emSign or eMudhra in any issuer line.

Step 2. Update the server's certificate list

On Ubuntu, update the ca-certificates package (USN-8944-1):

sudo apt update && sudo apt install --only-upgrade ca-certificates

Sansec lists fixed versions for Debian, Alpine, Fedora and Arch, and a manual workaround for RHEL, Rocky Linux, AlmaLinux and Amazon Linux 2023, which had no fix when it published. (Ubuntu, Sansec)

Step 3. Check bundles inside your code

Sansec says WordPress (wp-includes/certificates/ca-bundle.crt) and the Stripe PHP library ship their own certificate lists, which override the server's list, and that neither had a fixed release when it published. Its guide explains how to replace them. Node.js apps need Node.js 22.23.4, 24.22.1 or 26.12.1. (Sansec, Node.js)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. Google says no forged certificates from these authorities were logged before it blocked them, and eMudhra says it is not aware of the weak keys being used by anyone before the issue was disclosed. (Google, eMudhra) The risk for most sites is a broken padlock after October 27, not a break in.

Can EverThread tell me if I am affected?

Not specifically. EverThread checks your site's certificate from the outside and warns you when it has expired, is about to expire or is not trusted. It does not check for eMudhra or for this root, and it does not look at the certificate lists on your server. Use the one minute check above to see who issued your certificate.

My certificate is from eMudhra but a different root. Do I need to act?

Google's October 27 change covers certificates chaining to emSign ECC Root CA - G3. Google says it is also reviewing eMudhra's remaining roots. The Hacker News reports that Mozilla is not removing eMudhra's G1 root for now. But eMudhra is leaving the SSL/TLS business and says it will replace affected customers' certificates through partners, so ask your provider when and how your certificate will be moved. (Google, The Hacker News, eMudhra)

Where can I follow official updates?

The Google and Mozilla security blogs and eMudhra's incident statement.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan does not check whether your certificate comes from eMudhra. No account.

Or sign up free and we check it every day and email you when something changes.