www.it-connect.fr
Windows: Microsoft Pulls eMudhra Trust Certificates in Out-of-Band Updates
Microsoft has just released out-of-band updates for Windows to remove seven certificates linked to the eMudhra authority from its trusted certificate store. This update is primarily aimed at disconnected machines. Here’s what you need to know.
As a reminder, last week I published an article about the eight eMudhra private keys that could be guessed in just a few seconds. These keys belonged to eight intermediate certificates from the Indian certification authority eMudhra: six were used to issue HTTPS certificates, and the other two to sign code. Normally, a private key is a number chosen at random from an astronomical range of possibilities. eMudhra’s keys, generated in April 2025, were between 1 and 255. On October 17, 2026, a researcher nicknamed Wayne noticed this: it was enough to test those few values to recover the keys, and therefore issue certificates that would be recognized as legitimate.
Microsoft had already responded once on October 20, 2026. At that time, the Redmond company added the eight intermediate certificates to Windows’ Untrusted Certificates list and pushed a CRLSet update for Edge and WebView2 (without requiring a new browser version). In practice, these protections are delivered automatically to Windows machines... except for machines that do not contact Microsoft’s certificate update service.
Seven Certificates Removed from Windows Trust
On October 26, 2026, Microsoft went further. In a post on the MSRC blog, the Redmond company announced that it was removing seven certificates from the Windows trust list, all located at the top of the trust chains to which the eight compromised intermediates belong: six eMudhra G3 roots and one AAA Certificate Services cross-signing certificate. Those same certificates were scheduled to be removed from Microsoft Edge’s trust list on October 27.
For systems that normally receive these updates, no action is required. But who are Microsoft’s new out-of-band updates actually for?
They target disconnected environments where devices cannot reach Microsoft’s service, and environments where automatic CTL updates have been disabled. They include an updated certificate list:
Out-of-band updates dated the same day also appear in the update history for Windows 11 23H2 (KB5134130), Windows 11 26H1 (KB5134134), as well as Windows 10 1809 and Windows Server 2019 (KB5134124).
Note that KB5134133 is not offered through Windows Update: it must be downloaded from the Microsoft Update Catalog. You need to download it yourself and deploy it to the affected machines (for example, isolated machines). This is a cumulative update that includes the content from the October 13 Patch Tuesday (KB5127648).
What about machines managed by WSUS? It depends on their Internet access. Trust lists do not go through WSUS: each machine downloads them directly from ctldl.windowsupdate.com, as a web feed. A machine connected to WSUS that can reach this address will therefore receive the new lists on its own. If this feed is blocked by a firewall or proxy, you must install the out-of-band update or synchronize the lists to an internal share with the certutil -syncWithWU command, then redirect the machines to that share via Group Policy, as explained in Microsoft’s documentation.
Removing a Root Is Not the Same as Revoking a Certificate
Microsoft stresses the difference between blocking the eight compromised intermediate certificates on October 20 and removing the seven certificates from the trust list on October 26.
"Removing a root from a trust list is not the same as revoking the intermediate certification authorities known to be affected," the American vendor explains. This is a separate trust decision, broader than simply blocking the compromised keys.
In practical terms, any certificate that chains up to one of these seven roots will no longer be trusted by default, even if it was never issued by the compromised intermediate certificates. Microsoft is therefore asking administrators to identify these dependencies and obtain replacement certificates, or another trust chain, before the change reaches their machines.
The Redmond company rightly points out that you remain in control. "Organizations with a specific compatibility need may choose to locally trust a certificate, subject to their own security assessment and policies," Microsoft says.
For its part, eMudhra is not launching a new root: the certification authority has stopped issuing under its ECC G3 root. And above all, a radical decision was announced on October 22: its withdrawal from the global SSL/TLS certificate market, while keeping its RSA G1 roots active long enough for its customers to obtain a free replacement certificate from partners.
