Cybersecurity

Compromised eMudhra certificate keys: what to update and what to leave alone

2 min read

Linocut illustration of tongs lifting one gold master key off a ring of keys, above a row of small houses with lit windows and one isolated dark house on a hill, for the distrust of compromised eMudhra certificate authority keys.

Microsoft says automatic updates protect connected Windows PCs. Offline machines, apps with their own certificate bundles and Java runtimes need a manual update. Here is what to check.

In brief

Drafted with AI assistance and reviewed by the editor. Developing.

Eight eMudhra intermediate certificate authorities' private keys could be recovered, letting anyone forge trusted certificates. Microsoft says six were for TLS and two for code signing. eMudhra says it revoked all eight on 18 October and knows of no exploitation. The disclosure site says it is unknown whether attackers targeted clients that do not enforce Certificate Transparency.

Connected PCs and browsers

Microsoft says it blocked the eight CAs through the Windows Disallowed Certificate Trust List on 20 October. Edge and WebView2 got an automatic block needing no browser update. It advises letting automatic Windows certificate trust and Edge component updates reach devices. The disclosure site says Firefox, Chrome and Apple products also block the certificates. The site added on 28 October that the developer tools Apple ships with macOS, including git, curl and python3, still trust the compromised certificates, and that macOS 27.2 undid fixes users had applied. It advises updating browsers and operating systems.

Offline Windows machines

These need action. BleepingComputer reports that on 26 October Microsoft released out-of-band updates for systems that are offline, can't reach its certificate-update service or have automatic trust-list updates disabled. They are KB5134133 for Windows 11 24H2, 25H2 and 26H2 and KB5134125 for Windows 10 21H2 and 22H2. Microsoft says to ensure updates deliver the new lists; refreshed Azure Marketplace images are available for disconnected VMs. The 26 October update also removes seven certificates from the Windows trust list, six eMudhra G3 roots and an AAA Certificate Services cross-sign, and Microsoft removed the same seven from Edge's trust list on 27 October.

Apps with their own certificate bundles

The disclosure site warns that OS updates may not cover software shipping its own CA bundle:

  • Electron apps such as Slack and Discord: update each app; fixes need a rebuild on a patched Electron release.
  • Python certifi: upgrade to 2026.10.19 or later.
  • Linux: update the distribution's ca-certificates package. The site lists patched versions for Debian, Ubuntu, RHEL, Fedora, Alpine and others.
  • Java: Oracle JDK is patched; OpenJDK is pending. On Debian and Ubuntu, updating packages does not refresh packaged OpenJDK's keystore. As root, run rm -f /etc/ssl/certs/java/cacerts && update-ca-certificates --fresh.

Don't restore trust

Microsoft advises against restoring trust locally in the removed certificates without first assessing the risk. Software not checking revocation could then accept forged certificates, it says. Replace certificates chaining to the removed roots.

Sources and scope

The prioritisation is ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.