# Which root certificate did cert-manager v1.21.3 remove from its container images after the eMudhra CA compromise?

cert-manager, Easy (Beginner), Security. https://k8wiz.com/uquiz/which-root-certificate-did-cert-manager-v1213-remove-from-its-container-images-after-the-emudhra-ca-compromise

- A. eMudhra Root CA - G2
- B. emSign ECC Root CA - G3
- C. emSign Root CA - C1
- D. eMudhra ECC Root CA - G1

**Answer:** emSign ECC Root CA - G3

**Explanation:** The v1.21.3 release notes say the updated distroless base images no longer include the "emSign ECC Root CA - G3" root certificate. The release also moves to Go 1.26.10, whose crypto/x509 package rejects chains that pass through the compromised intermediates.