Website certificate alert: what the eMudhra issue means for you
A small group of website certificates will stop working in Chrome from 27 October. Most Indian sites are not affected, but it takes ten minutes to be sure.
· 3 min read · For departments, firms, schools and hospitals that run their own website, portal or app
If your office runs a website, a citizen portal or an app, you may have seen news this week about weak keys at eMudhra, a certifying company. Some staff may also be asking if their digital signature is still valid. Here is what happened, who is affected and what to check before 27 October.
What happened, and when
A website certificate is the small file behind the padlock in the browser. It proves a site is really who it says it is. Certificates are issued in a chain: a trusted root at the top, middle certificates below it, and your site's certificate at the end.
- On 17 October 2026, a researcher reported that the secret keys of eight of eMudhra's middle certificates were weak and could be worked out. Chrome blocked them the same day, without users needing to update or restart.
- On 18 October, eMudhra cancelled all eight. It says seven were never used in production and the eighth issued no certificates.
- Google has removed the root above them, called emSign ECC Root CA - G3, from Chrome's trusted list. The change is expected on the morning of 27 October, US Pacific time, which is the evening of 27 October in India.
From then, any website certificate that chains up to that root will stop working in Chrome. Visitors will see a warning instead of your page.
Who is affected, and who is not
eMudhra says most of its website certificates chain to other roots, and that the affected group is limited to one customer group in the United States. On 21 October, MeitY said the impact on Indian websites and apps was very limited and that it has set up a team to look into the matter.
Digital signature certificates (DSC) and eSign in India are not affected. Both eMudhra and MeitY have said so. If your staff sign GST returns, tenders or files with a DSC token, they need to do nothing.
What to check this week
- Look at your certificate. Open your site in a browser, click the padlock, and view the certificate details. Check the name at the top of the chain. If it says emSign ECC Root CA - G3, get a new certificate from another provider before 27 October.
- Check every address, not just the home page. Payment pages, staff logins, sub-sites and the server behind your mobile app often have their own certificates.
- Keep browsers and phones updated. The blocks reach people through normal updates. Google says restarting an Android phone picks up its fix sooner.
- Tell staff not to click past certificate warnings. A warning on a familiar site is a reason to stop and call IT, not to press "proceed anyway".
- Keep a simple list. For each site and app, note who issued the certificate, when it expires and who renews it. When the next alert comes, you can answer in minutes.
How we can help
For the sites and apps we build and run, we keep this list for you, renew certificates automatically and check the full chain after every change. We can also review a site you already have and tell you plainly if anything needs to change. Our security basics guide covers the other checks worth doing, and our services page explains how we look after live systems. If you are unsure about your own setup, talk to us.
