Abstract:
Microsoft recently released a support document update regarding the follow-up treatment plan for the eMudhra certificate incident: Starting from November 16, 2026, Windows systems will remove the remaining 10 eMudhra root certificates from the trusted list through the automatic certificate trust update mechanism.
Windows devices that can connect to the Microsoft Certificate Update Service will automatically receive certificate trust list changes, and the Microsoft Edge browser and WebView2 Runtime will also stop trusting related root certificates through a component update on November 16.
This deletion trusts the eMudhra root certificate:
Previously, eMudhra’s eight intermediate certificate private keys could be deduced due to generation errors, of which six were used for website TLS certificates and two were used for code signing certificates. Someone with these private keys could forge certificates and impersonate the website or software publisher.
Microsoft has blocked the affected intermediate certificates through the certificate update mechanism on October 20, and all leaf certificates issued by these intermediate certificates will also be automatically blocked. On October 26, Microsoft removed 7 root certificates related to the relevant certificate chain from the trust list, including 6 eMudhra G3 root certificates and AAA Certificate Services cross-signed certificates.
The arrangement on November 16 is to continue processing the remaining 10 eMudhra root certificates. Microsoft said that all Windows devices that can connect to Microsoft servers can automatically receive certificate trust list changes. This step does not require users to manually process or install updates.
Edge and WebView2 will be handled via component updates:
The Microsoft Edge browser and WebView2 Runtime will remove default trust for remaining relevant root certificates through the PKI Metadata component on November 16. Microsoft says the device checks once every 10 hours, and also after the app is launched, so both the Edge browser and apps using WebView2 can receive certificate trust changes through component updates.
For devices that have been offline for a long time and cannot connect to Microsoft servers, Microsoft will release an offline certificate update package in the future. At that time, IT administrators will need to manually download the certificate update package and update it on the relevant devices.
Related articles:
eMudhra withdraws from global SSL/TLS certificate business after shocking scandal
Enthusiasts use eMudhra leaked certificates to issue 106,000 certificates for Google, which can pass CA public key certification
Indian eMudhra company revokes 8 more intermediate certificates and investigates and finds more violations
Comments