eMudhra Exits TLS as Google Drops Root Certificate: What It Means for Indian Websites

What just happened?#

Imagine typing a web address to access a vendor portal or check an invoice, only for Google Chrome to throw up a stark warning screen: Your connection is not private. That is the exact headache landing on the desks of several Indian system administrators right now.

On October 27, 2026, Google formally removed eMudhra's root certificate, named emSign ECC Root CA – G3, from the Chrome Root Store. Industry reports and public certificate transparency trackers confirmed the deprecation after months of scrutiny around audit compliance and bug reporting timelines.

Rather than fighting to meet escalating compliance hurdles across global browser root programs, eMudhra decided to pull the plug on issuing public TLS (Transport Layer Security) certificates altogether. While the Bengaluru-headquartered trust services firm remains a powerhouse in India's domestic digital identity space, its chapter as a global website security provider has come to an unceremonious end.

The exit closes a long-running push by an Indian company to sit alongside Western giants like DigiCert and Sectigo on the global web security stage. But it also leaves lingering questions about why things unravelled, how clients were notified, and what this says about the fragility of web trust.

How does this actually work?#

To understand what went wrong, you have to look at how HTTPS works under the hood. When you visit a secure website, your browser does not take the site owner's word for it. It looks for a digital certificate signed by a Certifying Authority (CA).

Your browser—whether it is Chrome on Android, Safari on an iPhone, or Firefox on a laptop—comes pre-loaded with a list of trusted root certificates known as a Root Store. Think of it like the master guest list at a gated tech park. If a security guard recognizes the authority that signed your gate pass, you walk right in. If the authority is struck off that list, the gate slams shut.

Running a public root is notoriously demanding. The CA/Browser Forum, an industry body made up of browser makers and certificate authorities, enforces strict technical rules. Every misissuance, delay in revoking compromised certificates, or missed audit deadline must be reported publicly on issue trackers like Bugzilla.

Over the past two years, global browser teams raised queries regarding compliance delays, incident disclosure timing, and operational processes tied to eMudhra's public TLS operations. When browser maintainers lose confidence that an authority can consistently meet these rigorous operational standards, they remove the root certificate. Once removed from Chrome, any website presenting an SSL certificate derived from that root shows an untrusted error to visitors.

What changes for people in India?#

The first question most Indian professionals ask is practical: Will my Income Tax filing stop working? Can I still sign tenders on the GeM portal?

The short answer is no, your day-to-day office paperwork is safe. In India, eMudhra is best known for USB crypto-tokens, Class 3 digital signature certificates (DSCs), and Aadhaar-based e-Sign integrations. Those domestic services operate under the Indian Root CA managed by the Controller of Certifying Authorities (CCA), governed by the Ministry of Electronics and Information Technology (MeitY).

Google's action specifically targets public web browsing via Chrome's root store. It does not cancel eMudhra's domestic license to issue paperless DSCs for corporate tax filings, Registrar of Companies (ROC) submissions, or court filings. Those internal enterprise signatures do not rely on Chrome's web root store.

Where the trouble actually hits is website hosting. Any Indian university, cooperative bank, state department, or private company that purchased an emSign SSL certificate for their public-facing website faces a genuine crisis. If visitors access those sites using modern versions of Chrome, they see an alarming security screen warning of potential eavesdropping.

For an e-commerce site or local service portal, that warning screen kills web traffic instantly. Most everyday users will not click through advanced settings; they will simply hit the back button and assume the website got hacked.

What should you do now?#

If you run a business, manage servers, or oversee internal IT infrastructure, you cannot afford a wait-and-see approach. Here is the operational checklist to tackle right away:

First, audit your public domains and subdomains. Run your websites through free analysis tools like Qualys SSL Labs or use a quick terminal command to inspect the certificate issuer chain. Look closely for any reference to emSign or eMudhra in your active TLS certificates.

Second, if you spot an emSign certificate on an active web server or API endpoint, replace it immediately. You do not need to spend days negotiating contracts; automated alternatives like Let's Encrypt provide free, universally trusted certificates within minutes. Commercial options from DigiCert, Sectigo, or GlobalSign are also available if your organization demands enterprise warranties.

Third, check your internal API connections and mobile app endpoints. If your Android app communicates with a backend server that relies on an affected certificate, API calls may fail silently or throw network exceptions, breaking user transactions like UPI integrations or OTP verifications.

Finally, keep your DSC hardware tokens separate in your mind. If you are an auditor, company secretary, or government contractor using an eMudhra USB dongle for signing PDFs, continue using it as normal under CCA guidelines. The headache today belongs to webmasters, not tax filers.

What questions remain unanswered for Indian businesses?#

The decision to quietly pull the plug on public TLS certificates resolves the immediate standoff with browser makers, but it leaves paying clients holding the bag. Indian businesses that bought two-year or three-year emSign commercial SSL certificates are now forced to scramble for emergency replacements well ahead of their contract cycles. Industry watchers point out that while enterprise migrations are standard practice when security infrastructure changes, customers deserve transparent communication, transition roadmaps, and clear refund policies rather than discovering outages through sudden browser warning screens.

Beyond the immediate operational chaos, this episode raises uncomfortable governance questions for India's domestic tech ecosystem. For years, domestic security firms have championed technological sovereignty, urging local banks and government departments to patronize homegrown certification authorities over Western competitors. However, maintaining global trust requires relentless engineering discipline, absolute transparency during operational failures, and strict adherence to international timelines. When an Indian authority bows out rather than fixing its compliance workflows, it weakens the argument for local web sovereignty and makes enterprise CIOs think twice before betting on regional security alternatives.

Going forward, regulatory scrutiny from domestic bodies like the CCA and CERT-In will be critical to watch. While internal digital signatures remain legally valid and technically separate from browser stores, trust is not modular in the eyes of corporate clients. If an organization cannot meet the baseline transparency standards of public browser root programs, enterprise leaders will naturally question whether domestic compliance audits are rigorous enough. Addressing these lingering doubts requires open post-mortems and proactive vendor communication, ensuring Indian engineering retains credibility both at home and across the wider web.