Microsoft to Remove 10 eMudhra Certificate Roots From Windows Systems on November 16
Key Facts
Microsoft said it will remove 10 eMudhra-related roots from its Trusted Root Program on November 16, 2026, broadening the end of trust for affected certificates after intermediate keys were compromised. The change will reach Windows devices automatically if they can connect to the update service, the company said. Its plan also includes removing the affected root certificates from Azure Linux and updating virtual machine and container images on the same date. Microsoft said the compromised keys could allow certificates to be issued or content to be signed in a way that appears to come from a trusted entity. The incident occurred within the eMudhra chain and did not involve a breach of Microsoft systems, it added.
The incident stemmed from a flaw in a Python script designed to manage keys, according to an eMudhra report published in the Mozilla file. A line in the value-reading process truncated the private portion of ECDSA keys to the first byte, the report said; the reconstituted object was then created and used to issue certificates. The Mozilla file said eMudhra received a report on October 17, 2026, that the G3B and G3C keys could be recovered. On October 18, the company revoked the 8 intermediate certificates involved. Microsoft says exposure of the keys could permit the use of certificates that appear trusted, making the end of trust in them consequential beyond revocation of the specific certificates.
The Mozilla file recorded a further development on November 7, 2026, when 8 RSA intermediate certificates were revoked and withdrawn from service. Affected subscribers had begun moving to alternative issuance paths, the file said. eMudhra also said it had moved TLS certificates to alternative providers in all geographic regions except the United States, where a group of customers was still in the process of migrating. These steps indicate that the response covers affected certificates and customers, as well as changes to trust lists maintained by operating system and browser platforms. eMudhra did not specify in its statement when the migration in the United States would be complete.
Microsoft's plan coincides with other deadlines for ending trust in emSign G1 certificates. eMudhra said Chrome and Firefox trust programs set November 16, 2026, as the date to stop trusting these certificates, while Apple set November 30 for removing G1. That places Microsoft's deadline within a broader move by operating system and browser providers, with Apple's date differing from the other two. For organizations that rely on certificate chains linked to eMudhra, identifying the roots and subordinate certificates they use comes before the change. Microsoft advised organizations to check subordinate certificates and obtain alternatives before updates reach their devices.
Microsoft stressed that removing a root from a trust list differs from revoking an intermediate certificate authority known to be affected. The change therefore requires reviewing systems' and services' reliance on the roots being removed, as well as monitoring Windows and Azure Linux updates. Microsoft shares closed at $521.13 on November 11, 2026, according to EL7 data, the latest close available before the date of the news. On October 22, EL7 published an earlier story about Mozilla blocking eMudhra certificates after keys for 8 certificates were exposed. November 16, 2026, is the next step in removing the roots and updating Azure Linux images, while Apple's deadline to remove G1 remains November 30.