Microsoft ships Windows trust-list update after eMudhra key compromise
Original title: Microsoft releases out-of-band Windows fixes with certificate updates
The October 26 update removes seven eMudhra-related certificates for devices that do not get automatic CTL updates.
Microsoft released a non-security out-of-band Windows update that refreshes the certificate trust list after Indian CA eMudhra’s private keys were compromised earlier this month. The October 26 package, for supported systems from Windows 10 through Windows 11 and Windows Server 2025, removes six eMudhra G3 roots and an AAA Certificate Services cross-sign. It also includes the October 13 update, whose VPN, on-premises Exchange, Smart App Control, audio, and Remote Desktop issues remain. Devices that already receive automatic CTL updates generally do not need it. Edge and WebView2 got a separate CRLSet release.
Unconfirmed: Microsoft describes potential misuse of the stolen keys; the article does not report fraudulent certificates actually issued.
- Microsoft says the keys could be used to create certificates or sign content as a trusted CA.
- Seven certificates were removed from the Windows trust list on October 26.
- The package carries forward unresolved issues from the October 13 update.
- Most devices that reach Microsoft’s certificate-update service do not need this release.
Impact: Stolen CA keys could forge certificates that appear trusted
| Product | Affected |
|---|---|
| Microsoft Windows | Windows 11, Windows Server 2025, and Windows 10 |
- 1.Install the October 26 out-of-band update where automatic certificate trust list updates are unavailable.
- 2.Expect the October 13 VPN, Exchange, Smart App Control, audio, and Remote Desktop issues to remain.
- Countries
- India
From the original article
2 min read at theregister.comDid you hear the one about eMudhra and the power of 4? Time to get connected to certificate trust list updates
By Richard Speed · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.