eMudhra SSL certificate blocked: do you need to replace yours?

A certificate is the small file that lets your website use https, the secure connection that keeps what visitors type private. Without a working one, browsers show a full-page warning and most visitors leave.

This month, browsers decided not to trust certificates from one certificate authority, an Indian company called eMudhra. From 27 October 2026, Chrome removes one of its roots from the list of authorities it trusts. If your website’s certificate came from that chain, visitors could start seeing warnings.

Most small business sites are not affected. But “most” is not a good enough answer for your own site, so here is what happened, how to check in a few minutes, and what to ask if you need a replacement.

What happened

A certificate authority is an organisation browsers trust to vouch that a website is really the website it says it is. The trust works like a chain. At the top is a root, which browsers carry on a built-in list. Below it sit intermediate certificates, which the root authorises to do the day-to-day issuing. Your website’s certificate hangs at the bottom.

On Saturday 17 October 2026, a security researcher reported that eight of eMudhra’s intermediate certificates had private keys that anyone could work out. A private key is the secret that proves a certificate is genuine. Whoever holds it can make certificates that browsers would accept as real, for any website at all.

The keys were not stolen. They were badly made. The Next Web reports the keys should have been random 384-bit numbers, but the eight keys turned out to be tiny numbers such as 4 and 56. One security researcher is reported to have recovered all eight in under a second. eMudhra says the weak keys came from a flaw in a key-generation ceremony held on 30 April 2025, which produced a second, weak set of keys alongside the strong ones.

Then the browsers moved quickly:

• 17 October: Chrome blocked the six affected website certificates, and Firefox blocked them that night.
• 19 and 20 October: Apple and Microsoft followed.
• 20 October: Mozilla removed the root above those intermediates, called emSign ECC Root CA - G3, from Firefox’s trusted list.
• 22 October: eMudhra announced it is leaving the global business of issuing website certificates altogether.
• 27 October: Chrome removes the same root. Google’s guidance is that the change reaches all devices that use Chrome’s trust list on the morning of 27 October, Pacific time.

What is not the problem

Two things are worth keeping apart, because the news has mixed them up.

First, nobody has reported that a fake certificate was made with the weak keys. eMudhra says none of the eight intermediates issued certificates to customers, and that only one of them was ever used in production. Google reports that no certificate chaining to the six website keys has appeared in the public logs of issued certificates.

Second, eMudhra says its Indian digital signature and eSign services, the ones used for tax returns and document signing, run on separate systems and are not affected.

So this is not “your site was hacked”. It is “a chain of trust was broken, and the browsers are removing it before anyone can use it”. The risk for you is practical: if your certificate sits on that chain, your site may stop loading cleanly.

Is my website affected?

Probably not, if you use a standard hosting plan. Most hosts and website builders issue free certificates from Let’s Encrypt or a similar authority, and they renew them on their own. Those are on different chains.

You are more likely to be affected if:

• your certificate was bought separately from a reseller rather than coming with your hosting,
• your company is in India or does business with Indian partners, where eMudhra is better known,
• an IT company set up your server and you never saw who issued the certificate, or
• you run things beyond the website: a shop’s payment connection, an app that talks to your site, an office server or a security camera system.

About 30,000 certificates under the removed root need to move, according to what eMudhra told Mozilla on 20 October. That is the company’s own figure for one root, not a count of everything it issued.

How to check in five minutes

You do not need any special tool for the first look.

1. Open your website in Chrome, Edge or Firefox.
2. Click the icon at the left of the address bar, next to your domain name. The exact words differ by browser, but you are looking for “Connection is secure” and then “Certificate”.
3. Find the line that says Issued by, or the certificate path.
4. If it says eMudhra or emSign anywhere, treat your certificate as affected.
5. If it says Let’s Encrypt, Google Trust Services, Sectigo, DigiCert, Cloudflare or your host’s name, you are very likely fine.

Two warnings. Sub-domains such as shop. or mail. can have their own certificates from different authorities, so check those too. And a certificate that renews automatically may not have been replaced before 27 October, so look at what is installed today.

If your website is behind a service like Cloudflare, visitors see Cloudflare’s certificate, but your own server may still carry a different one behind it. Cloudflare has said customers who run their own origin servers may need to update things themselves.

What to do if your certificate is affected

Google’s advice to website owners is direct: get a new certificate from a different certificate authority and install it. Do not wait for a visitor to complain.

eMudhra says it will move affected customers to other providers free of charge over the next three to four weeks, and CSO Online reports that customers of its CertiNext service can request Sectigo certificates through their account. Whether you take that route or buy your own, the questions to put to whoever looks after your site are:

• Which authority issued every certificate we use, including sub-domains and mail?
• Has each one been replaced with a certificate from a different authority?
• Did anyone check the new certificate in a real browser after installing it?
• Do our shop, app, payment connection and any partner link still work?

Never click through a certificate warning to see the page anyway, and never tell customers to. India’s national cyber agency, CERT-In, gives the same advice: do not bypass certificate warnings.

The part people forget: software outside the browser

The browsers fixed this quickly, and updated Chrome and Firefox blocked the certificates without anyone needing to restart. Other software is slower. Many programs that are not browsers keep their own list of trusted authorities, and many do not check whether a certificate has been cancelled. Command-line tools, programming libraries, containers, payment gateways and office equipment can keep trusting the weak certificates until someone updates them.

If your developer runs scripts or integrations that call your site or your suppliers, ask whether the software behind them has been updated this month. SSL.com’s guidance lists these non-browser systems as the ones most likely to be missed.

What is still not known

Be wary of anyone who sounds certain about the rest. Reports say eMudhra’s older G1 roots are still active, and that Mozilla is retiring two other eMudhra roots at the company’s own request. Google is reported to be still investigating whether the remaining roots should stay in Chrome. eMudhra has not published a full timeline, and it says an auditor’s final incident report will take two to three weeks.

The sensible plan is to move off eMudhra completely rather than rely on the roots that survive for now.

A valid certificate is only one part

A secure connection also depends on sending visitors to the secure version every time, and on protecting login cookies. Each can fail on its own. Our earlier posts on Black October and what it means for your website and on the CAA record, which lets you name the authorities allowed to issue certificates for your domain, cover the wider picture.

Want us to check yours?

• Free: run the website security checker. It looks at whether your site uses https and whether it tells browsers to insist on it. It does not read who issued your certificate, so do the five-minute check above as well.
• Done for you: our website security service looks at the whole connection as an outsider sees it, ranks what to fix first and fixes it in a safe order, without taking your site offline.

Then reach us:

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

If you find eMudhra on your certificate and your site is already showing warnings, say so in the first line and we will look at it first.

Sources and further reading

• The Next Web: Eight eMudhra certificate keys were so weak that one was the number 4
• ThePrint: What’s the eMudhra security scare that has rattled the internet
• Inc42: eMudhra to exit certificate business as security flaw triggers distrust
• CSO Online: eMudhra quits global TLS certificate market after compromise of CA signing keys
• SSL.com: Check your certificates before 27 October, Chrome is removing an eMudhra root