Do Son 
Microsoft recently updated its technical guidance regarding the ongoing eMudhra cryptographic incident. Specifically, Windows systems will revoke trust for the remaining ten eMudhra root certificates starting November 16, 2026. The operating system distributes this change through its automatic Certificate Trust List update mechanism. Consequently, internet-connected Windows devices will adopt the updated trust store without user intervention. Furthermore, Microsoft Edge and WebView2 Runtime will distrust these root certificates on the exact same date.
Background of the Compromised eMudhra Certificates
Earlier, researchers discovered that attackers could easily deduce private keys for eight eMudhra intermediate certificates. A flawed generation script weakened six website TLS certificates and two code-signing certificates. Therefore, malicious actors holding those keys could forge credentials to impersonate trusted websites or software publishers. As documented in the Microsoft Security Response Center advisory on eMudhra, engineers acted swiftly to contain the risk.
Specifically, Microsoft blocked the eight compromised intermediate certificates via automated updates on October 20. This emergency action immediately invalidated all leaf certificates issued under those weak chains. Subsequently, Microsoft purged seven related root certificates from its trust store on October 26. That initial batch included six eMudhra G3 roots and one AAA Certificate Services cross-signed certificate. Now, the November 16 update eliminates trust for the remaining ten eMudhra root certificates across Windows devices.
Component Updates for Edge and WebView2 Runtime
Alongside core operating system updates, browser environments will enforce identical cryptographic restrictions. Specifically, Microsoft Edge and WebView2 Runtime will revoke default trust through the PKI Metadata component. Client devices query this metadata service roughly every ten hours and during every application launch. As a result, browser instances and WebView2 applications will receive the certificate revocation seamlessly.
Offline Update Packages for Air-Gapped Systems
However, air-gapped workstations cannot communicate with Microsoft cloud servers to fetch automatic trust updates. To protect isolated networks, Microsoft will publish a standalone offline certificate update package soon. Meanwhile, IT administrators managing disconnected environments must download and deploy that package manually. Ultimately, removing compromised eMudhra root certificates shields enterprise infrastructure against forged TLS and code-signing threats.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
