Google plans to remove eMudhra’s emSign ECC Root CA - G3 from the Chrome Root Store after eight intermediate keys proved recoverable, a change that could disrupt websites using the root.
In an initial estimate given to Mozilla, eMudhra put the number of certificates requiring migration at about 30,000. Website operators will need to replace affected certificates to avoid disruption. Google warned that some legitimate certificates chaining to the root may stop working in Chrome after the removal.
Mozilla said it independently recovered all eight private keys from their public certificates after a researcher reported the weakness on Oct. 17. Six keys belonged to intermediates for website certificates; the other two belonged to code-signing intermediates. Chrome and Firefox blocked the affected intermediates that day, with the protections reaching users at different times. eMudhra revoked them Oct. 18.
A fraudulent website certificate signed with one of the affected keys could have allowed someone intercepting a connection to pose as a site and inspect or change the traffic, Mozilla said.
Google found no website certificates chaining to the six affected website intermediates in Certificate Transparency logs before Chrome applied its block. Google said certificates from those intermediates could not have worked in Chrome during that period because the browser requires such logging. The log review does not establish whether certificates were used against software without that requirement.
eMudhra’s preliminary explanation points to an error in a wrap-and-unwrap step during an April 30, 2025, key-generation ceremony. The error produced a second set of weak keys that staff selected by mistake, the company said. eMudhra said its root certificate authority private keys were unaffected, the eight intermediates issued no end-entity certificates, and it found no infrastructure intrusion or data breach.
eMudhra said its global website-certificate business accounts for around 1% of revenue, without specifying a reporting period. It said its India digital-signature and eSign businesses operate separately. Mozilla is also removing the root from a trusted-certificate list used by other applications that may not have received Firefox’s block.
Google plans to remove emSign ECC Root CA - G3 from the Chrome Root Store on Oct. 27. Operators whose certificates depend on the root face replacement work before that change.
