Microsoft removes seven eMudhra-linked roots from Windows trust list

Microsoft has released an out-of-band Windows update that removes seven certificates tied to affected eMudhra intermediate certificate authority keys, and it plans to remove the same certificates from the Microsoft Edge trust list on Tuesday, October 27. The issue involves eight eMudhra intermediate CA private keys, six associated with TLS and two with code signing, that could be recovered and potentially used to create certificates or sign content that appeared to come from a trusted CA; it arose in eMudhra's certificate hierarchy and was not a compromise of Microsoft systems. Customers whose certificates chain to one of the seven removed certificates should find those dependencies and obtain replacements before the changes reach their devices.

Immediate protections already deployed

On October 20, Microsoft published an update to the Windows Disallowed Certificate Trust List to block the affected certificate authorities. Microsoft also deployed a separate CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates signed by those authorities. The Edge and WebView2 update is delivered automatically through the component update mechanism and does not require customers to install a new browser version. These protections address the identified compromised intermediate keys and are separate from eMudhra's revocation of the affected intermediate certificates.

Roots removed from trust lists

The October 26 out-of-band Windows update removes six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust list. Microsoft plans to remove the same seven certificates from the Microsoft Edge trust list on Tuesday, October 27. Once the changes reach a device, these certificates will no longer be trusted by default through the respective trust lists. Removing a root from a trust list is a broader trust decision than revoking the known impacted intermediate certificate authorities, and it is separate from the earlier protections that blocked the compromised intermediate keys.

What customers should do

Keep updates flowing by allowing automatic Windows certificate trust updates and Edge component updates to reach devices. For disconnected Windows devices, make sure the update process delivers the updated Disallowed Certificate Trust List and the upcoming trust-list changes. Review disconnected Azure devices running on Virtual Machine Scale Sets or single-instance VMs; updated images are available in Azure Marketplace. If any certificates chain to one of the seven certificates being removed, find those dependencies and get replacement certificates or an alternative trusted chain before the changes reach your devices. Organizations with a specific compatibility need may choose to trust a certificate locally, subject to their own security assessment and policies, but should not restore trust in an affected hierarchy without understanding the associated risk.

Further review

Microsoft is evaluating the remaining eMudhra roots separately and will sequence any further changes as affected customers transition away from those hierarchies. Microsoft continues to investigate the scope of this issue and will update its post if additional findings or trust changes materially affect customers.

Earlier coverage: Eight eMudhra CA private keys compromised, browsers enabled emergency blocking

Sources: Microsoft · The Register · Microsoft Support