Windows Drops 7 eMudhra Certificates: What to Install
Microsoft out-of-band updates remove seven eMudhra-linked root certificates from Windows. KB numbers and who needs to install them by hand.
Microsoft has pushed out-of-band Windows updates that remove seven certificates tied to eMudhra from the Windows trust list. If your PCs update normally, you probably don't need to do anything. If you look after offline machines or servers with automatic certificate updates turned off, keep reading.
What happened
This follows the eMudhra weak key problem I covered last week. Private keys for eight eMudhra intermediate certificate authorities turned out to be recoverable: six for TLS and two for code signing. Microsoft stresses that its own systems weren't compromised.
Per the MSRC response, Microsoft first updated its Disallowed certificate list on October 20 and pushed a CRLSet for Edge and WebView2. On October 26 it released out-of-band updates that take seven certificates (six eMudhra G3 roots and the AAA Certificate Services cross-signed certificate) out of the Windows trusted root store. It says removal from Edge's own trust list is planned as well.
The update numbers are:
- Windows 11 26H1: KB5134134
- Windows 11 26H2, 25H2 and 24H2: KB5134133
- Windows 11 23H2: KB5134130
- Windows 10 22H2 and LTSC 2021: KB5134125 (builds 19045.7811 and 19044.7811)
- Windows 10 LTSC 2019 and Server 2019: KB5134124
- Server 2025: KB5134137, Server 2022: KB5134140, Server 2016: KB5134123
Why it matters
Certificates are how Windows decides whether a website or a signed program is real. A leaked CA key means someone could, in theory, issue certificates that look valid. Most Windows PCs fetch trust-list changes automatically, so Microsoft says these updates are mainly for devices that don't: air-gapped machines, systems with automatic root updates disabled by policy, and some server images.
Microsoft also says it's still evaluating the remaining eMudhra roots, so this may not be the last step. Sites and apps that rely on eMudhra-issued certificates could start breaking on Windows as this goes on.
What to do
- Home user? Keep Windows Update on and you're covered.
- For offline or locked-down machines, grab the right KB from the Microsoft Update Catalog and install it by hand.
- If you run Azure VM scale sets or golden images, rebuild them with the update included.
- If your own site or software uses an eMudhra certificate, replace it with one from another CA now.
- On a Mac too? Here's how to check for eMudhra certificates in Terminal. And if the update hangs, see my Windows Update stuck fix.
Comments ()