By Sarah Reid, Securetron. I am Sarah Reid, with Securetron, and this is a practical briefing for teams that still have certificates chaining to the affected eMudhra roots.
Today, October 27, 2026, is the day Chrome started removing the emSign ECC Root CA-G3 root. Tomorrow, October 28, 2026, is the deadline in AWS bulletin 2026-150-AWS for replacing certain Application Load Balancer (ALB) OIDC/JWT certificates. If you have not inventoried your chains yet, those two dates leave no room to treat this as a routine renewal cycle.
What changed on October 27
Chrome started removing the emSign ECC Root CA-G3 root on October 27, 2026. In practical terms, a root removal means Chrome will no longer trust certificates that chain to that root. That is the point of a root store decision: it is not a warning about a single certificate, it is a change to the trust anchor underneath a whole set of certificates.
The scale of the remaining exposure was already visible before removal day. About 30,800 unexpired precertificates were counted on October 21, with 99.9 percent issued via InCommon intermediates. Those figures are reported in coverage of the Chrome removal, drawing on Certificate Transparency data. See: Chrome Removes eMudhra Root — Convika and Tanium on finding and fixing eMudhra exposure.
Do not read the precertificate count as a count of live, in-use leaf certificates in your environment. Precertificates are the Certificate Transparency records created before issuance. The count shows how widely the affected chains were used, and why a manual, one-certificate-at-a-time check is not a sufficient response. Your job is to find the chains you actually rely on, not to debate the global total.
Oracle and Java: a second emergency alert
Browsers are not the only trust store that matters. Oracle issued a second emergency Java alert on October 24, CVE-2026-114820, with a CVSS score of 9.1, removing affected roots. Source: Oracle Security Alert CVE-2026-114820.
That matters because Java applications, services, and build and runtime environments often carry their own trust stores, separate from the browser. A certificate that is replaced for Chrome may still be trusted — or still be relied on — in a Java trust store until that store is updated, and a Java client that has removed the root will reject a chain that other parts of your stack still accept. Check both. The browser deadline and the Java update are part of the same trust change, not two unrelated incidents.
The October 28 AWS deadline
AWS bulletin 2026-150-AWS requires ALB OIDC/JWT certificates chaining to the three affected roots to be replaced by October 28, 2026. Source: AWS Security Bulletin 2026-150-AWS.
Read that requirement narrowly and act on it literally:
- It is about ALB OIDC/JWT certificates, not every certificate in your AWS account.
- It is about certificates chaining to the three affected roots named in the bulletin.
- The replacement deadline is October 28, 2026.
If you run ALBs with OIDC or JWT authentication, check the certificate chain for each listener and identity configuration now. A certificate that looks valid in the console can still chain to an affected root. Replace it with a certificate chaining to a trusted root, test the OIDC/JWT flow end to end, and confirm the old certificate is no longer in use before you assume the deadline is met.
What to do today: a short, checkable list
1. Inventory chains, not just certificates. List every TLS, OIDC, and JWT certificate in use, then inspect the full chain for each one, including intermediates. The InCommon intermediate figure in the October 21 count is a reminder to look past the leaf: an intermediate can tie an otherwise ordinary-looking certificate to an affected root.
2. Search Certificate Transparency and your own records. Use CT logs to find precertificates and certificates for your domains, and reconcile them with your internal inventory. If CT shows a chain you do not recognize, treat it as a finding to investigate, not as background noise.
3. Prioritize ALB OIDC/JWT first. Those are the certificates with an explicit October 28 AWS deadline. Replace, redeploy, and test authentication before moving on to lower-priority renewals.
4. Check Java trust stores separately. Apply the Oracle alert, update Java trust stores, and test Java clients and services that validate these chains. Do not assume a browser fix covers a Java runtime.
5. Reissue from a trusted CA and verify the new chain. After replacement, confirm the new chain in a browser, in your ALB configuration, and in any Java or non-browser client that validates it. Keep the old certificate out of rotation; a replaced certificate that is still configured somewhere is not replaced.
6. Monitor after replacement. Watch for trust errors, failed OIDC/JWT validations, and client complaints in the days after October 27 and 28. Root removals surface in client errors first, and the error is often reported as an authentication failure rather than a certificate problem.
The Securetron PKI Trust Manager angle
This is the kind of problem PKI tooling exists to make visible: which certificates you have, which roots and intermediates they chain to, when they expire, and where each one is actually deployed. Without that inventory, teams discover affected chains one outage at a time.
Disclosure: I am Sarah Reid, with Securetron. Securetron PKI Trust Manager is Securetron's offering in this area, intended to help teams inventory certificates and track their trust chains. The Community Edition is free for up to 500 certificates, per the product information in the source material for this article.
Whether you use PKI Trust Manager or another inventory, the questions to answer before October 28 are the same: can you list every certificate chaining to an affected root, can you prove each ALB OIDC/JWT certificate has been replaced, and can you show the new chain validates in Chrome, in AWS, and in Java? If you cannot answer all three from one inventory, the inventory is incomplete.
Bottom line
Chrome started removing the emSign ECC Root CA-G3 root on October 27, 2026. Oracle had already issued its second emergency Java alert on October 24 for CVE-2026-114820, CVSS 9.1, removing affected roots. AWS requires ALB OIDC/JWT certificates chaining to the three affected roots to be replaced by October 28, 2026. About 30,800 unexpired precertificates were counted on October 21, 99.9 percent via InCommon intermediates — a measure of how widely these chains were used, and why checking only the certificates you remember is not enough.
Replace the affected chains, verify the new ones in every trust store that matters, and do it before the October 28 deadline, not after the first failed login tells you that you missed one.
Sarah Reid is with Securetron.
Sources: Convika, https://convika.com/blog/chrome-removes-emudhra-root-2026-10-27/ ; Tanium, https://www.tanium.com/blog/emudhra-ca-compromise-find-and-fix-your-exposure-with-tanium ; Oracle, https://www.oracle.com/security-alerts/alert-cve-2026-114820.html ; AWS, https://aws.amazon.com/security/security-bulletins/2026-150-aws/
Top comments (0)