eMudhra's board voted on Oct 22 to withdraw from global SSL/TLS, five days after a researcher reported that the private keys of eight of its intermediate CAs were trivially small. The company says SSL/TLS was about 1% of revenue, that no end-entity certificates were issued from the affected CAs, and that its infrastructure wasn't breached. Its G1 RSA roots will keep serving customers during the transition, it will replace affected certificates free through unnamed partners, and revocation and status services will run until every certificate expires. No exit date was given.

The Hacker News, citing Google, reports Chrome will stop trusting emSign ECC Root CA - G3 around Oct 27. Mozilla made the same call on Oct 20. About 30,800 unexpired certificates chain to that root, 99.9% of them issued through InCommon for higher education. ACME clients won't replace them early unless they support ARI or someone renews by hand. If you hold an InCommon or emSign ECC certificate, replace it now (universities are pointing users to RSA certificates or Let's Encrypt).