On October 22, 2026, Indian certificate authority eMudhra announced it will withdraw from the global SSL/TLS certificate business, five days after a researcher recovered the private keys of eight intermediate CA certificates — every one of them below 256. If your organization issues certificates under the emSign ECC Root CA - G3 root, you have until October 27 to move to another hierarchy.

On 29 September 2026, Cloudflare announced its intent to become a public certificate authority, twelve years after launching Universal SSL, with a root acquired from GlobalSign and applications to the Chrome, Apple, Microsoft, and Mozilla root programs. It is targeting post-quantum certificates and Merkle Tree Certificates as early as Q1 2027: a second mass-scale free provider is taking shape, and your ACME deployment chain must be able to switch.