Microsoft will remove trust in remaining eMudhra roots in November

Microsoft has updated its guidance on the eMudhra certificate incident, stating that Windows systems will revoke trust for the remaining ten eMudhra root certificates on 16 November 2026. The change will be delivered via automatic Certificate Trust List updates, so internet-connected Windows devices will adopt the updated trust store without user action.

Microsoft Edge and the WebView2 Runtime will apply the same distrust on the same date, through the PKI Metadata component that browsers and apps query roughly every ten hours and at startup.

The threat timeline described by Microsoft shows that researchers found attackers could deduce private keys for eight eMudhra intermediate certificates due to a flawed generation script, enabling forged credentials for impersonating trusted websites or software publishers. In response, Microsoft blocked the eight compromised intermediates via automated updates on 20 October, invalidating all leaf certificates issued under those weak chains.

On 26 October, seven related root certificates were purged from the trust store (six eMudhra G3 roots and one AAA Certificate Services cross-signed certificate). The forthcoming 16 November update completes the removal by detrusting the remaining ten eMudhra root certificates across Windows devices. For air‑gapped systems, Microsoft will publish an offline certificate update package to be downloaded and deployed manually.