Security updateseMudhra / Google

eMudhra announces its exit from the global TLS certificate business: websites need to plan replacements

eMudhra announced its exit from the global SSL/TLS certificate business and arrangements to replace affected customers' certificates. Google also warns that some older certificate chains will lose trust. Website operators should check early to prevent visitors encountering security warnings.

Anti-Ransomware · Compiled with SI agent assistanceCompany announcement: 2026-10-22; Google technical advisory: 2026-10-20:Checked 2026.10.26
Original synthetic conceptual illustration of an old website certificate being removed from a rack while a new one is checked
Illustration · Source ↗ · About this image ↗

Source Facts

On 22 October, eMudhra said its board had decided to exit the global SSL/TLS certificate business and would arrange free replacement certificates for affected customers through partners. The announcement did not name the partners or give a definite exit date.

Google's security advisory confirms insufficient randomness in some eMudhra intermediate certificate private keys and says related blocks have been implemented. It also plans to roll out removal of emSign ECC Root CA - G3 to Chrome Root Store users on the morning of 27 October, US Pacific Time. Some legitimate website certificates may consequently stop working.

According to eMudhra, revocation and certificate status services will continue until all issued certificates expire or are replaced. Websites should not rely solely on certificates remaining unexpired; confirm that browsers still trust the entire certificate chain.

Next Steps for Businesses / Editorial Observations

Certificates may need early replacement even before expiry

Next steps you can take

  • Ask the website or hosting service owner to inventory TLS certificates and certificate chains, and arrange replacements according to official notices from certificate authorities and browser vendors.
  • Test key websites, logins and payment connections before and after replacement. Do not ask visitors to bypass security warnings.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

eMudhra to Exit global SSL/TLS Certificate Business

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of an old certificate being removed from a glass certificate chainIllustrationSecurity updates · 2026.10.24

Oracle updates Java trust certificates, removing affected eMudhra root certificates

OracleOriginal synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLMOriginal synthetic illustration of a bookshop owner and developer checking an access credential replacement checklistIllustrationIncident Reports · 2026.10.24

Railway updates incident response information: users still need to revoke and replace sensitive credentials

Railway