# Chainguard:  Removing trust in a compromised certificate authority (eMudhra emSign G3)

- Impact (vendor’s label): minor
- Status: ongoing · edited after publishing
- Started: 2026-10-20 17:09 UTC · Resolved: not resolved · Duration: ongoing
- Updates: 2 · Affected components: Image builds & releases
- Vendor status page: n/a
- [Company: Chainguard](https://rewindex.com/company/chainguard.md)

## Timeline of updates

- **degraded** 2026-10-20 17:09 UTC: We are aware of the recently disclosed compromise of the eMudhra emSign G3 certificate authority, which has been distrusted across the ecosystem (including by Mozilla and the Go project). Our services are operating normally. As a precaution we are actively updating all Chainguard container images to remove trust in the affected certificate authority, matching the wider ecosystem.
- **degraded** 2026-10-20 21:59 UTC: Our image catalog is almost completely rebuilt with updated certificates. However, catalog synchronization and publishing are still underway. Check your registry often to see the build status of your own images. Official communications are coming soon with detailed guidance on impact and workarounds. Check your communication opt-ins in the Chainguard Console to ensure you see them.

## Rewindex changes for this incident

- 2026-10-20 22:03 UTC: [Incident updated:  Removing trust in a compromised certificate authority (eMudhra emSign G3)](https://rewindex.com/change/r57b0d2993933f0.md)


---
Canonical: https://rewindex.com/company/chainguard/incidents/1096060 · Markdown: https://rewindex.com/company/chainguard/incidents/1096060.md · JSON: https://rewindex.com/api/v1/companies/chainguard/incidents/1096060 · Generated 2026-10-20T23:37:19.473Z