What Chrome's emSign Certificate Date Means for You

On November 4, 2026, the Chrome Root Program said that some website certificates from eMudhra will lose Chrome's default trust. The certificates chain to emSign Root CA - G1. If the earliest signed certificate timestamp is after November 16, 2026 at 11:59:59 PM UTC, Chrome 153 and higher will not trust them by default. That timestamp, often called an SCT, is a time mark written when the certificate is logged. It tells the browser when the certificate was issued.

A visitor can hit a warning and leave, even while your server is still running. I help owners catch that kind of surprise early. Website monitoring is $5 a month, and you can reach me at greg@ableadmins.com. Details are on the website monitoring page.

What Chrome reported

The November 4 post points back to October 17, 2026. A researcher reported eight eMudhra subordinate certificate authority key pairs generated with near-zero entropy. Entropy is the randomness that protects a key. Chrome said that with almost none of it, the private keys were trivially recoverable. Those subordinate authorities are the signers a root allows to issue certificates for sites.

Chrome said it blocked the affected TLS intermediate certificate authority keys with a CRLSet update. A CRLSet is Chrome's block list for keys browsers should reject. Chrome also removed CN=emSign ECC Root CA - G3, OU=emSign PKI, O=eMudhra Technologies Limited, C=IN in Chrome Root Store Version 43.

Google's October 20, 2026 post, updated November 4, 2026, gives the times. The report arrived at 18:05 UTC on October 17. The CRLSet block of the intermediates' SPKI hashes landed at 19:45 UTC. An SPKI hash is a fingerprint of a public key. Google said no TLS certificates chaining to the six affected intermediates were in Certificate Transparency logs before that block. Those logs are the public record of issued certificates.

The same post said removal of emSign ECC Root CA - G3 was expected to reach all devices that rely on the Chrome Root Store on the morning of October 27, 2026 PDT. Google said site operators with certificates chaining to that root must install a new TLS certificate from another hierarchy in the Chrome Root Store.

The November 16 line for G1

Chrome set a further rule for CN=emSign Root CA - G1, OU=emSign PKI, O=eMudhra Technologies Limited, C=IN. TLS server authentication certificates that validate to that root, and whose earliest SCT is after November 16, 2026 at 11:59:59 PM UTC, will no longer be trusted by default in Chrome 153 and higher. Chrome said this change aims to coincide with the Chrome 158 Stable release on November 17, 2026.

Certificates that validate to the same G1 root, with an earliest SCT on or before November 16, 2026 at 11:59:59 PM UTC, are unaffected. Explicitly trusting the root overrides that SCT constraint. Chrome's example is a Windows Group Policy Object, a setting a company can apply to its own Windows computers. Chrome said the date and approach may shift if new information comes to light.

Chrome also said eMudhra had announced it would withdraw from the global SSL/TLS business. SSL and TLS are the encryption a browser uses with your site. Chrome said eMudhra had not shown that the risk stopped at the known weak certificate authority keys.

What eMudhra said on November 5

eMudhra's November 5, 2026 update says Chrome and Mozilla Firefox set an SCTNotAfter date of November 16, 2026 for emSign G1 certificates. eMudhra says that does not affect certificates issued before those dates. eMudhra said Apple indicated removal of G1 on November 30, 2026. After that, eMudhra said, all certificates issued under G1 would stop being trusted on Apple platforms.

eMudhra also said it had moved emSign TLS certificates to other providers everywhere except a US customer community still in progress. It expected those remaining customers to move before Apple's date. The issuer name on your certificate is how you see whether it chains to emSign.

What you can check

A few minutes in the browser, plus one note to your host, is enough to see whether this notice is about your site.

Open your site and view the certificate. Write down any issuer name that includes emSign.
If you see emSign ECC Root CA - G3, Google said to install a new TLS certificate from another hierarchy in the Chrome Root Store.
If you see emSign Root CA - G1, ask your host for the earliest SCT and compare it with November 16, 2026 at 11:59:59 PM UTC.
Ask whether your certificate has already moved to another provider. eMudhra said that move was done everywhere except a US customer community still in progress on November 5.
Ask how Apple's November 30, 2026 removal of G1 applies to your certificate.

If you want a check on whether the site is answering while you sort this out, website monitoring is where I set that up.

How Able can help

Website monitoring is $5 a month. I aim it at the address your customers use, and it lets you know when that address stops answering. Send the address to greg@ableadmins.com and I will help you read the issuer and decide what to ask your host. The vendor posts below have the full names and timestamps.

Sources

When you want a quiet watch on the site through these dates, website monitoring is ready for you.