TORONTO, October 25, 2026 —

The eMudhra certificate incident now has a deadline. In security bulletin 2026-150-AWS, published October 24, 2026, Amazon Web Services told customers to replace certificates chaining to three removed roots — AAA Certificate Services, emSign Root TLS CA – G3, and emSign ECC Root CA – G3 — by October 28, 2026. CloudFront is removing the roots from its edge CA bundle by that date, and Application Load Balancers using OIDC or JWT authentication must have identity-provider certificates from an AWS-trusted authority in place by the same day, ahead of ALB trust-store updates rolling out October 29–31.

The bulletin traces the incident to CVE-2026-111943: eight eMudhra/emSign intermediate CA private keys — six TLS and two code-signing — that were trivially recoverable because of catastrophic entropy failures in P-384 key generation. The issuing CA revoked the affected intermediates on October 18, and the cross-signing CA revoked its copies on October 19, so clients that enforce OCSP or CRL checks fail-closed are not affected. But revocation does not solve the deadline problem: any identity-provider endpoint or origin server still presenting a chain that terminates at one of the three removed roots will fail validation once the managed trust bundle changes — even though its certificate has not expired and its server has not been compromised.

"An unexpired certificate is not the same as a trusted certificate," said Sarah Reid, Securetron spokesperson. "That is the lesson of this deadline. A chain can be valid, unexpired, and served by a healthy server — and still break on October 28, because the trust store on the other side of the connection changed. If you cannot list every certificate in your estate by issuer, chain, and the trust store that validates it, you cannot know whether you are affected. And three days is not enough time to build that inventory by hand."

The exposure is easy to underestimate because it hides in places spreadsheets never reach: an identity provider behind an ALB, an origin server behind CloudFront, a webhook endpoint, a service-to-service connection validated against a managed bundle. AWS's own rollout shows how staggered the risk is — its shared trust store was updated October 21, STS and Cognito are done, botocore 1.43.117 is out, Bottlerocket AMIs land October 26–28, RDS for SQL Server follows October 30, and EMR on October 31. Each service changes on its own schedule, so fixing one dependency does not fix the rest.

PKI Trust Manager, Securetron's certificate lifecycle platform, is built for exactly this kind of forced migration: it continuously discovers certificates across the enterprise — including the ones no spreadsheet lists — maps each one to its issuer and chain, and automates issuance, renewal, and deployment, with ACME, SCEP, and EST enrolment native and ADCS and MSCA support built in. Expiry alerting with configurable lead times and a single compliance and audit pane across ADCS, MSCA, Let's Encrypt, DigiCert, and ACME mean the next trust-store change starts from a complete inventory instead of a scramble. Its Community Edition is free for up to 500 certificates, and AI-driven onboarding with Boltron-AI profiles applications and generates onboarding runbooks so newly found certificates get under management instead of back into a spreadsheet.

"The teams that will sleep fine on October 28 are the ones who already know every chain they own," Reid added. "Everyone else is about to learn the difference between managing certificates and managing trust — on a deadline someone else set."

About Securetron
Securetron builds enterprise security infrastructure: PKI Trust Manager with Boltron-AI for certificate lifecycle automation, and AI-FW, the self-hosted AI firewall and governance gateway between AI agents and LLM backends. For more information, visit https://securetron.net.

Press contact:
Sarah Reid
Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]