Summary
- Microsoft removed seven eMudhra-related trust certificates from Windows on 26 October.
- The company scheduled equivalent Microsoft Edge trust-list removals for 27 October.
- These root-level removals are separate from the earlier blocking of weak intermediate certificates; disconnected systems may miss updates.
Microsoft issued an out-of-band Windows update on 26 October to remove seven certificates from trusted-root lists following the eMudhra certificate authority incident. The company scheduled corresponding removals from Microsoft Edge’s trust list for 27 October. These platform-level trust decisions are separate from its earlier protection against compromised intermediate authorities.
The Windows change removes six eMudhra G3 root certificates and an AAA Certificate Services cross-sign. A service or application with a chain terminating at one of these anchors may stop validating it by default once the relevant Windows or Edge change reaches the device. Microsoft says the trust removal reflects concerns about recoverable keys in parts of eMudhra’s intermediate certificate hierarchy, not a breach of Microsoft systems.
On 20 October Microsoft had already blocked the affected intermediates using a Windows Disallowed Certificate Trust List update and a separate Edge/WebView2 CRLSet change. Removing higher-level trust certificates on 26–27 October has a broader effect on certificate chains, including applications whose certificates were not among the weak intermediates themselves.
Beyond the initial revocations
On 20 October Microsoft published a Disallowed Certificate Trust List update addressing the compromised intermediates, alongside browser component measures that block affected TLS certificates. Removing seven higher-level trust certificates on 26 October represents a broader decision than blocking those specific weak intermediates.
The seven comprise six eMudhra G3 roots and an AAA Certificate Services cross-sign. Their removal means a certificate chain relying on those trust anchors may no longer validate by default on updated devices. An organisation can have a validly configured application and still experience certificate errors if its trust path depends on a root the platform has withdrawn.
Microsoft distinguishes the new root-level change from eMudhra’s revocation of issuing intermediates. The two defences address different points in the public key infrastructure: one prevents known weak issuers from being accepted, while the other changes the trust status of a larger part of the certificate hierarchy.
The move also raises a transition problem for systems that use those roots legitimately. Microsoft says organisations with a particular compatibility requirement can make a local trust decision after assessing the risk, but should not restore an affected hierarchy without understanding its security implications. A bypass adopted simply to remove an error could negate the protective change.
The disconnected-device issue
Windows devices normally receive updates to certificate trust information automatically. Machines isolated from the internet, devices on restricted industrial networks and systems where certificate list updates have been disabled can miss those changes. Microsoft’s out-of-band packages are intended to help such deployments receive the relevant trust updates through controlled software-distribution processes.
Disconnected estates are common in regulated and operational environments where direct external network access is restricted. Their isolation may reduce some attack paths, but it does not guarantee that every file, application or encrypted connection reaching the environment is safe. Trust-store maintenance remains necessary wherever the operating system evaluates digital certificates.
Microsoft also identified Azure virtual machines and scale sets as environments requiring review where automatic updating is constrained. Updated images are available for affected customers, and administrators are advised to identify certificates chaining to the removed roots and arrange replacements or alternative trusted chains.
A certificate chain’s reach can be broader than a website’s visible public certificate. Enterprise applications, middleware, device-management systems and internally distributed software may rely on a particular authority. Mapping dependencies before the change reaches production can reduce avoidable service disruption, although retaining risky trust anchors is not an equivalent substitute for replacing affected chains.
Microsoft says it is separately evaluating eMudhra roots that remain trusted and may sequence further changes as customers migrate away. That means the trust-list response is not necessarily complete merely because the seven certificates have been removed.
Microsoft’s Windows trust-list removal took effect through its 26 October emergency update, with Edge’s corresponding change scheduled for the following day. The company is evaluating other eMudhra roots separately, so further platform trust changes remain possible while dependent customers migrate.
