Chrome and Firefox stop trusting new eMudhra G1 certificates

Chrome and Firefox stop trusting new eMudhra G1 certificates

5 November 2026: TLS certificates that chain to eMudhra's emSign G1 roots and are issued after 16 November 2026 will not be trusted by Chrome or Firefox, and on 30 November Apple removes the G1 hierarchy altogether, so every G1 certificate stops working on Apple devices however long it has left to run. The Indian certificate authority set out the dates in the eighth update to its incident page, and the cut-off reaches organisations that moved onto G1 only weeks ago as a refuge from the compromised G3 intermediates.

Not yet independently verified. The Chrome, Firefox and Apple dates are as eMudhra relays them in its incident update of 5 November; we have not found the root programmes' own notices, and eMudhra gives no date for the end of G1 issuance. We will update this when it can be confirmed, and remove this note.

Two different kinds of cut-off

Chrome and Firefox are applying what the root programmes call an SCTNotAfter date. A certificate issued before 16 November keeps working until it expires; one issued after it is rejected. eMudhra says this "does not impact any existing certificates issued before these dates".

Apple's step is harsher. From 30 November the whole G1 hierarchy is untrusted on its platforms, so a certificate issued on 10 November with a year to run fails in Safari and in any app using Apple's trust store on that day. A website or API that serves iPhone, iPad or Mac users therefore has two weeks, not a year, to replace a G1 certificate.

How eMudhra got here

On 17 October a researcher reported that eight emSign G3 intermediate TLS authorities, created at a key ceremony in April 2025, had weak and recoverable private keys, a fault eMudhra traced to an error in a script. They were revoked on 18 October. eMudhra then moved affected customers to G1, offered free certificates issued by Sectigo, appointed KPMG on 30 October as an independent reviewer, and announced it would leave the global SSL and TLS business, which we reported when it exited the market.

By eMudhra's account every emSign TLS customer outside the United States has already moved to another provider. One large US group remains: its update of 28 October said roughly 30,800 certificates under the affected G3 hierarchies belonged to a single US client ecosystem, which has been running on the G1 pathway since, and eMudhra expects it to finish moving before Apple's date. G1 issuance stops "once the federation's transition is complete", with no date given.

What a certificate holder should do now

Any certificate chaining to emSign G1 should be replaced before 30 November if Apple users reach the service, and no new G1 certificate should be ordered after 16 November for browser-facing use. eMudhra's page gives the routes: CertiNext users request a Sectigo certificate from their account, US customers write to support@certinext.io, and others contact eMudhra support. Its digital signature, eSign, emSigner, emCA and SecurePass products are unaffected, by its own account.

Press reports also give dates for Microsoft's removal of the remaining eMudhra roots, but we have not found a Microsoft notice, and eMudhra's page does not name one.

Sources

• eMudhra: Certificate security incident, update 8, 5 November 2026
• iTnews: eMudhra fiasco widens, 12 November 2026