Chrome removes a compromised CA root today, breaking some HTTPS certs
Chrome drops emSign ECC Root CA - G3 from its trust store on 27 October after eMudhra intermediate keys turned out to be forgeable. Sites chaining to it need a new certificate now.
Google said it is removing emSign ECC Root CA - G3 from the Chrome Root Store on the morning of 27 October, Pacific time. The root belongs to eMudhra, whose eight subordinate CA certificates turned out to have private keys generated with insufficient randomness, meaning they could be forged.
Chrome moved fast when it found out: at 19:45 UTC on 17 October it pushed a CRLSet update blocking the affected intermediates by their key hash, no browser update needed. Android got equivalent protection through Google Play Services two days later. Today’s root removal is the next step, and Google is blunt about the fallout: any site with a certificate chaining to that root, even one that was never touched by the compromised intermediates, stops validating in Chrome.
Google’s instruction to site operators is to immediately acquire and install a new TLS certificate from a different PKI hierarchy in the Chrome Root Store, rather than wait and see what breaks.
Why it matters: Chrome is the trust store most of the web depends on. If any certificate on your sites, servers or internal tools chains to emSign ECC Root CA - G3, it fails today, not on some future deprecation date. Check your chain now rather than after something stops loading.
The caveat: Google’s post doesn’t give a count of affected live certificates, so there’s no way to size the blast radius precisely. Treat “check your own chain” as the only reliable test.