By Sarah Reid, Securetron. I am Sarah Reid, with Securetron, and this is a practical briefing for teams that still have certificates chaining to the affected eMudhra roots.

Today, October 27, 2026, is the day Chrome started removing the emSign ECC Root CA-G3 root. Tomorrow, October 28, 2026, is the deadline in AWS bulletin 2026-150-AWS for replacing certain Application Load Balancer (ALB) OIDC/JWT certificates. If you have not inventoried your chains yet, those two dates leave no room to treat this as a routine renewal cycle.

What changed on October 27

Chrome started removing the emSign ECC Root CA-G3 root on October 27, 2026. In practical terms, a root removal means Chrome will no longer trust certificates that chain to that root. That is the point of a root store decision: it is not a warning about a single certificate, it is a change to the trust anchor underneath a whole set of certificates.

The scale of the remaining exposure was already visible before removal day.…