Google Orders emSign G3 Certificate Replacements by Oct. 27 After 8 Key Compromises
Updated
Updated · InfoWorld · Oct 23
Google Orders emSign G3 Certificate Replacements by Oct. 27 After 8 Key Compromises
3 articles · Updated · InfoWorld · Oct 23
Summary
Google said Chrome will stop trusting eMudhra’s emSign ECC Root CA – G3 on the morning of Oct. 27 Pacific time, forcing website operators to replace any TLS certificates chaining to that root.
Eight compromised intermediate CA private keys triggered the move; Mozilla has already removed the same root from its trust store, while Google said no affected certificates appeared in Certificate Transparency logs before blocking.
eMudhra is exiting the global SSL/TLS business and offering free Sectigo-issued replacements, while keeping revocation and certificate-status services running until all certificates are replaced or expire.
Analysts warned that swapping a browser-facing certificate may miss hidden dependencies in Java keystores, containers, proxies, VPNs and embedded devices; Azul released JDK updates to block the eight affected certificates.
The episode highlights a broader fourth-party risk: many enterprises know their reseller but not the CA hierarchy, cross-signing and trust stores underpinning critical services.