Microsoft Pulls eMudhra Root Certificates from Windows Trust Store After Key Compromise

On October 26, Microsoft released out-of-band updates to Windows systems to revoke trust in certificates derived from compromised eMudhra certificate authority keys. These patches target environments that lack access to automatic certificate trust list updates, including offline systems and devices unable to reach Microsoft's certificate-update infrastructure.

The KB5134133 update applies to Windows 11 versions 24H2, 25H2, and 26H2, while KB5134125 covers Windows 10 versions 21H2 and 22H2. The updates specifically address systems where automatic Certificate Trust List (CTL) updates have been turned off or are unavailable.

Weak Keys Enable Rapid Recovery

The incident stems from the discovery of eight eMudhra intermediate certificate authority private keys that exhibited severe cryptographic weaknesses. All eight keys were generated in April 2025 and possessed values smaller than 256, meaning attackers could recover them by brute-forcing just 256 possible numbers.

Possession of these keys would have enabled threat actors to forge certificates for legitimate domains and establish man-in-the-middle positions against encrypted communications. Following disclosure, eMudhra revoked the eight compromised intermediate certificates, and major software vendors including Mozilla, Google, and Apple initiated their own revocation procedures.

Microsoft's Multi-Layered Response

Microsoft's initial response involved updating the Windows Disallowed Certificate Trust List to block all eight affected intermediate certificate authorities—six designated for TLS and two for code signing. The company also deployed a CRLSet update for Microsoft Edge and WebView2 that blocked affected TLS certificates without requiring a full browser release.

The latest action goes further by removing seven certificates from the Windows trust list entirely. These seven certificates comprise six eMudhra G3 root certificates and one AAA Certificate Services cross-signed certificate.

On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list

Microsoft

By removing the root certificates themselves, Microsoft is taking a broader action than simply blocking the identified compromised intermediate keys. The same seven certificates will be removed from the Edge trust list on October 27.

Trust Removal Versus Revocation

Microsoft clarified the distinction between its current action and traditional certificate revocation. According to the company, "Removing a root from a trust list is not the same as revoking the known impacted intermediate certificate authorities. This is a separate trust decision, broader than blocking the identified compromised intermediate keys. Organizations with a specific compatibility need may choose to trust a certificate locally, subject to their own security assessment and policies."

Guidance for Administrators

Microsoft recommends that administrators deploy the update to disconnected Windows systems and conduct an inventory of any certificates that depend on the removed roots. Such certificates may require replacement to maintain operational continuity.

The company is continuing to investigate the remaining eMudhra root certificates and may implement additional trust modifications if warranted by findings.