How to Check Your Website's Certificate Issuer in Chrome for the eMudhra emSign Change in Pakistan
See in two clicks in Chrome if your website uses an eMudhra emSign certificate. The G3 root is out of Chrome and new G1 certificates fail after 16 November.
To check whether your website uses an eMudhra (emSign) certificate, open the site in Chrome, click the icon left of the address bar, open the certificate details and read the "Issued By" line. If the chain ends in emSign ECC Root CA - G3, Chrome no longer trusts it: replace the certificate now with one from another authority. If it ends in emSign Root CA - G1, move before 16 November 2026: Chrome 153 and later will not trust G1 certificates first logged after that date.
Google removed the emSign ECC Root CA - G3 from the Chrome Root Store, with a rollout planned for 27 October 2026, after eight eMudhra intermediate certificates were found to have weak keys. As of 8 November 2026, that root is not in the Chrome Root Store list in Chromium's own source code. The older root, emSign Root CA - G1, was still listed.
New on 4 November 2026. Google added an update to its announcement. Website certificates that chain to emSign Root CA - G1 and whose earliest Signed Certificate Timestamp (SCT, the public log entry made when a certificate is issued) is after 16 November 2026, 11:59:59 pm UTC, will not be trusted by default in Chrome 153 and higher. In Pakistan time that cut-off is 4:59:59 am on 17 November. G1 certificates logged on or before that moment are not affected by this change. In plain terms: a G1 certificate you already have keeps working until it expires, but any new or renewed G1 certificate after 16 November will fail in Chrome.
On 22 October 2026 eMudhra announced that it will leave the global SSL/TLS certificate business, the certificates that secure websites. Its other services, such as digital signature certificates (DSC) and eSign, carry on. Most Pakistani sites use other issuers, so this is a five-minute check, not a panic. Menu wording in Chrome changes between versions, and we describe the common layout without having opened your site.
Your certificate issuer is in the certificate details of the padlock menu
Click the icon at the left end of the address bar, choose "Connection is secure", then "Certificate is valid". A certificate window opens. Read the "Issued By" line and the certification path. A valid certificate will name the authority that signed it.
Look at the top of the certification path for the root name. If you see "emSign" or "eMudhra" anywhere in the chain, your site depends on that authority. The same window shows the expiry date, which tells you how long you have to replace it.
| You see in the chain | What it means | Action |
|---|---|---|
| emSign ECC Root CA - G3 | Removed from Chrome's trusted list | Replace now |
| EM DV, OV or EV TLS CA - G3B or G3C | One of the compromised intermediates | Replace now |
| emSign Root CA - G1 | Trusted if logged by 16 November 2026; later G1 certificates fail in Chrome 153 and up | Do not renew with eMudhra; move before your expiry date |
| Another authority | Not named in the advisory | No action for this incident |
Check every domain and subdomain, not just the main site
A company may use several certificates: the main site, a shop subdomain, an email server and an API. Each has its own issuer, and an old one bought by a previous agency is easy to forget.
List every address your business runs and check each one. Your hosting company or web agency can give you the list of certificates on your account.
Replace an emSign certificate with one from another authority
Google tells site owners with certificates under the G3 root to get a new certificate at once from another authority that Chrome trusts. Order one, install it on the server, then confirm the issuer line has changed.
What eMudhra says about its exit. In its 22 October 2026 announcement, eMudhra said its board decided to withdraw from the global SSL/TLS certificate business. It said it will contact affected customers and replace their certificates free of cost through partners during the move. Its revocation and certificate status services will keep running until every certificate it issued has expired or been replaced. With Chrome's 16 November cut-off for G1, do not buy or renew a website certificate from eMudhra now.
- Write down which domains show an emSign issuer.
- Order a new certificate from a different authority.
- Install it, including the intermediate certificate your new issuer provides.
- Reload the site and check that the issuer has changed.
- Test email, API and app connections that use the same domain.
Some hosts offer free certificates and renew them for you. Ask yours. Before you pay for any certificate, run through how to check a website's padlock, because fake certificate sellers exist.
Email servers, apps and devices may need attention too
A certificate is not only for websites. Mail servers, VPN gateways, payment links and internal tools may chain through emSign too. The advisory says that browser updates do not secure apps and devices that keep their own list of trusted certificates.
Ask your IT person to check Java, Python, Node.js and container images, and any appliance that inspects HTTPS traffic. Keep browsers updated on all office PCs and phones. Fixed browser releases came out within days of the report. If you find a problem, report it to PKCERT. Our guide on reading a PKCERT advisory explains how to tell whether a notice applies to you.
While you are checking the server, look for other weak points. The October 2026 PHP flaw was used to plant hidden files on sites, so check your website for a web shell in the uploads folder and update the PHP version on your hosting at the same time.
What happens if you do nothing
If a site relies on a root that Chrome stops trusting, visitors on Chrome see a full-page warning instead of your site. Most will leave. Payment pages, login pages and API calls from apps can fail without any warning to you.
Other browsers may not change on the same day. Mozilla blocked the eight compromised intermediates in Firefox within hours. So your own test on one device may look fine while customers on another see errors.
The cheapest fix is a new certificate from another authority, which many hosts provide free. Keep the old certificate files until the new one is confirmed working.
Related guide for business owners: if your company also publishes on YouTube, check your YouTube channel for the inauthentic content rule before AI template videos cost you monetisation.
Common questions about checking a certificate issuer
Do ordinary visitors need to do anything?
No special step. They should keep their browser updated and not click through certificate warnings.
Has the emSign root already left Chrome?
Yes for the G3 root. It is not in the Chrome Root Store list in Chromium's source code as of 8 November 2026. Treat any certificate under it as broken in Chrome.
What changes for emSign Root CA - G1 on 16 November?
Chrome 153 and later will not trust G1 website certificates whose earliest log timestamp is after 16 November 2026, 11:59:59 pm UTC (4:59:59 am PKT on 17 November). Certificates logged before then keep working until they expire.
Is eMudhra still selling website certificates?
No new plans should rely on it. eMudhra announced on 22 October 2026 that it is leaving the global SSL/TLS certificate business. Its digital signature (DSC) and eSign services continue.
Is my site unsafe if it uses emSign?
Not by that fact alone. The risk is that the root is no longer trusted, so visitors see errors. Under the G3 root, that has already happened in Chrome.
Where do I find the expiry date?
In the same certificate window that shows the "Issued By" line.
Who do I ask if I cannot tell?
Ask your hosting company or web agency for the certificate list, or email the issuer in writing.
How we verified this
What we checked and where we read it.
Last checked 8 November 2026. We read Google's Chrome security announcement of 20 October 2026, including its 4 November 2026 update on the G1 root, and the Chrome Root Store list in Chromium's source code, which lists emSign Root CA - G1 and not the G3 root. We also read eMudhra's press release of 22 October 2026 on leaving the SSL/TLS business.
First checked 22 October 2026. The affected certificate names, the Chrome removal date of 27 October and the replacement advice come from National CERT's advisory NCA-20.211026 and Mozilla's security blog post, both of which we read. The Chrome menu path is the common layout and may differ slightly between versions.
About the author
Technology Journalist & Multimedia Producer
Ahmad Ali is a technology journalist and multimedia producer at Pakistan Era, joining the team in October 2026. He covers consumer technology and digital life for Pakistani readers, combining research with hands-on product testing.
