Microsoft Releases Windows Certificate Update After eMudhra Key Compromise
The eMudhra compromise prompted Microsoft to remove trusted certificates from Windows, but some organizations may need to take additional steps to ensure their systems are protected.
Key Takeaways:
- Microsoft has released an out-of-band update following the compromise of eMudhra certificate signing keys.
- This update removes affected certificates and refreshes Windows certificate trust information.
- Organizations with offline or tightly managed devices should verify that endpoints receive the updated trust list.
Microsoft has released an out-of-band update for Windows after the compromise of certificate signing keys belonging to eMudhra, which is an Indian certificate authority. This incident raised concerns that attackers could potentially create fraudulent certificates or sign malicious content that would appear trustworthy to Windows devices.
To protect customers, Microsoft removed affected certificates from its trust infrastructure. However, systems that cannot connect to Microsoft’s certificate update service, or those with automatic certificate trust list (CTL) updates disabled, might not receive these protections automatically. As a result, those devices could continue trusting compromised certificates, which could create potential security risks when validating websites, applications, or signed content.
Microsoft updates Windows certificate trust lists
Microsoft released a non-security out-of-band update that refreshes Windows’ certificate trust list across supported versions, including Windows 11, Windows 10, and Windows Server. This update removes seven certificates linked to the affected eMudhra certificate hierarchies and ensures disconnected or managed devices receive the latest trust information. Microsoft had already blocked the compromised certificates through its Windows Disallowed Certificate Trust List and issued related protections for Microsoft Edge and WebView2.
This update strengthens certificate trust and helps organizations mitigate risks from the compromised certificate authority, but it also includes all fixes and known issues from Microsoft’s October cumulative updates.
Administrators deploying this patch may still encounter unresolved problems affecting VPN connectivity, on-premises Exchange Server environments, Smart App Control, audio functionality, and Remote Desktop access for non-admin users. Organizations must analyze the security gains of updating certificate trust against the possibility of introducing existing update-related disruptions.
This update is particularly relevant for organizations operating isolated, highly managed, or offline systems where certificate trust updates are not automatically delivered. Enterprises relying on internal update processes should verify that affected endpoints receive the revised certificate trust list, especially in light of the eMudhra compromise. Moreover, IT teams should test this update carefully before broad deployment because it carries forward several unresolved issues from October’s cumulative releases.
Rabia has a master's degree in Software Engineering and she has years of experience writing professionally about Microsoft products and other technologies. Rabia has also written for OnMSFT.com as well as Windows Report. She is always up to date on t...
