Microsoft ships out-of-band Windows updates to distrust eMudhra certificates

Microsoft has released out-of-band Windows updates that remove trust in certificates tied to compromised eMudhra certificate authority keys. The updates target systems that don't receive automatic certificate trust updates.

Two packages shipped on October 26: KB5134133 for Windows 11 versions 24H2, 25H2 and 26H2, and KB5134125 for Windows 10 versions 21H2 and 22H2. They are meant for machines without internet access, devices that can't reach Microsoft's certificate-update service, and systems where automatic Certificate Trust List (CTL) updates have been disabled.

Eight keys and 256 guesses

The trigger was the discovery of eight eMudhra intermediate CA private keys so weak they could be recovered almost instantly. All eight were generated in April 2025, and each had a value smaller than 256, so recovering a key took no more than trying 256 numbers.

With such keys, attackers could have forged certificates for legitimate websites and intercepted encrypted traffic. After the disclosure, eMudhra revoked the eight compromised intermediate certificates, and Mozilla, Google, Apple and other software vendors began blocking them as well.

What Microsoft has done so far

Microsoft had already added all eight intermediate CAs to the Windows Disallowed Certificate Trust List: six were used for TLS and two for code signing. For Microsoft Edge and WebView2, it pushed a CRLSet update that blocked the affected TLS certificates without requiring a browser update.

The new update goes further, removing seven certificates tied to the affected hierarchies from the Windows trust list: six eMudhra G3 roots and an AAA Certificate Services cross-sign. This also removes trust in the root certificates used to verify other certificates issued by the CA. The same seven certificates were slated for removal from the Edge trust list on October 27.

Microsoft stresses that removing a root from a trust list is not the same as revoking the known compromised intermediate CAs. It is a separate and broader trust decision. Organizations with specific compatibility needs may choose to trust a certificate locally, subject to their own security assessment and policies.

Admins are advised to install the update on disconnected Windows systems and identify any certificates that depend on the removed roots, as these may need to be replaced. The company is also reviewing the remaining eMudhra roots and may make further trust changes if needed.

Source: Bleeping Computer