Google Chrome Root Program

New Capabilities

Blocked affected certificates; began removing emSign ECC Root CA - G3 on October 27

Eight intermediate certificates from eMudhra, an Indian certificate authority, had private keys a computer could guess in under a second. eMudhra first blamed an April 2025 key-generation ceremony, then acknowledged on October 26 that a script error produced the weak keys. Browsers and operating systems are now removing trust in the parent root, not just the eight certificates.

Updated Oct 30