> TLS server authentication certificates validating to CN=emSign Root CA - G1, OU=emSign PKI,O=eMudhra Technologies Limited,C=IN whose earliest Signed Certificate Timestamp (SCT) is dated after November 16, 2026 11:59:59 PM UTC, will no longer be trusted by default in Chrome 153 and higher.
I wonder why they chose a future date (yes, it coincides with the next Chrome release) for stopping trust.. rather than the starting date of the discovery. As soon as everyone knew the private key (when news first broke, if not a few days before) any certs issued under this intermediate were suspect.
This is not an intermediate; they presumably block the 8 bad intermediates already (there's the vulnerability website to confirm that) while blocking other intermediates that are not known to have any problem is more disruptive to (ex-)customers of eMudhra the shorter the grace period.
> TLS server authentication certificates validating to CN=emSign Root CA - G1, OU=emSign PKI,O=eMudhra Technologies Limited,C=IN whose earliest Signed Certificate Timestamp (SCT) is dated after November 16, 2026 11:59:59 PM UTC, will no longer be trusted by default in Chrome 153 and higher.
I wonder why they chose a future date (yes, it coincides with the next Chrome release) for stopping trust.. rather than the starting date of the discovery. As soon as everyone knew the private key (when news first broke, if not a few days before) any certs issued under this intermediate were suspect.
This is not an intermediate; they presumably block the 8 bad intermediates already (there's the vulnerability website to confirm that) while blocking other intermediates that are not known to have any problem is more disruptive to (ex-)customers of eMudhra the shorter the grace period.