Windows, Chrome and Firefox Drop Trust in eMudhra Certificates

Microsoft, Google, Mozilla and Apple have moved quickly to stop trusting parts of eMudhra, an Indian certificate authority, after researchers found that private keys behind eight of its intermediate certificates were so weak they could be guessed almost instantly. Microsoft shipped an out-of-band Windows update on 26 October 2026, and the knock-on effects reach far beyond browsers, into Python tools, containers and other software that carries its own list of trusted certificates.

Here is what happened, who is affected and what IT teams should check now.

What went wrong at eMudhra

Certificate authorities (CAs) issue the digital certificates that let browsers and apps confirm they are talking to the real website or running genuine software. Their private keys must be impossible to guess. On 17 October, a researcher reported to Apple, Google, Microsoft, Mozilla and eMudhra that the private keys of eight eMudhra intermediate CAs were extremely small values, which meant they could be recovered with very little effort.

Six of the eight intermediates were used for website (TLS) certificates and two for code signing. eMudhra revoked them on 18 October. According to the company’s explanation, reported by security outlets, a key generation ceremony in April 2025 accidentally produced a weak second set of keys that was then used by mistake, and the problem went unnoticed for around 18 months.

Microsoft stressed that the issue sat in eMudhra’s certificate hierarchy and was not a compromise of Microsoft systems. It warned that the recoverable keys could be used to impersonate websites and intercept communications, or to make malicious software look as if it came from a trusted publisher.

How the big platforms responded

Microsoft Windows and Edge

• 20 October: Microsoft updated the Windows Disallowed Certificate Trust List to block the affected intermediates, and pushed a CRLSet update that blocks the affected TLS certificates in Edge and WebView2 through automatic component updates.
• 26 October: an out-of-band Windows update removed seven certificates from the Windows trust list: six eMudhra G3 root certificates and an AAA Certificate Services cross-sign. The Register reports that the release for Windows 11 24H2, 25H2 and 26H2 is KB5134133, and that the update also covers older supported versions, including Windows 10 and Windows Server.
• 27 October: the same seven certificates were removed from Edge’s trust list.

Microsoft says many devices receive certificate trust changes automatically through its update service. The out-of-band update matters most for machines that cannot reach that service or have automatic trust list updates turned off. The Register notes that the update rolls in everything from the October 13 release, including its known issues, so admins should test before broad deployment.

Chrome, Firefox and Apple

Chrome and Firefox blocked the six TLS intermediates within hours. Google said it found no website certificates from them in public Certificate Transparency logs before Chrome’s block, so it believes none could have been used against Chrome users. Mozilla decided to stop trusting the emSign ECC Root CA – G3, Chrome scheduled removal of trust in that root for 27 October, and Apple has blocked it as well.

eMudhra steps back from web certificates

eMudhra’s board decided on 22 October to exit the global SSL/TLS certificate business, according to The Hacker News. The company says it will keep revocation services running until its existing website certificates expire or are replaced, and its digital signature businesses continue. Google counted about 30,800 unexpired certificates under the affected ECC root as of 21 October, the vast majority issued through the InCommon service used by universities.

Why this matters beyond browsers

Updating Windows or Chrome is not the end of the story. Many tools ship their own bundle of trusted certificates and ignore the operating system’s list. Security researchers have flagged that older versions of pip, the Python package installer, bundle a certifi package that still trusts the affected G3 root; fixes arrived in pip 26.2.2 with certifi 2026.10.19. The uv Python tool, Go, Python’s own ssl module, Java and Node.js have also released updates that remove or block the affected certificates.

That means build servers, CI pipelines, Docker images and Python virtual environments can keep trusting the bad hierarchy even on a fully patched machine. Each container image and virtual environment carries its own copy, so each one needs checking.

Who is affected

• Everyday users on up-to-date Windows, Edge, Chrome, Firefox and Apple devices are largely protected already, provided automatic updates are on.
• IT teams with offline or restricted machines, such as servers on isolated networks or PCs with automatic certificate updates disabled, need to apply the out-of-band update or distribute the updated trust lists themselves.
• Developers and DevOps teams using Python, Go, Java, Node.js or containers should update runtimes and rebuild images.
• Website owners with eMudhra certificates, including those issued through partners, need replacements from another trusted CA. Visitors may see errors once trust is removed.

What you should do

1. Keep automatic updates on. Make sure Windows certificate trust updates and Edge component updates reach every managed device.
2. Patch offline systems. Install the 26 October out-of-band update, or deploy the updated Disallowed and trusted root lists through your own update process.
3. Update developer tooling. Upgrade pip and certifi, uv, Go, Java and Node.js to the patched releases, then rebuild container images from fresh base images.
4. Check your own certificates. If any of your sites or services use certificates that chain to eMudhra, replace them with certificates from another trusted CA now.
5. Don’t restore trust as a quick fix. Microsoft advises against re-adding removed certificates locally without a proper risk assessment, since some software does not reliably check revocation.
6. Watch for updates. Microsoft says it is still evaluating eMudhra’s remaining roots, so further trust changes may follow.

Sources

• Microsoft: Response to compromised eMudhra CA keys
• The Register: Microsoft releases out-of-band Windows fixes
• The Hacker News: eMudhra to exit global SSL/TLS business
• Brandefense: eMudhra CA keys, Python, uv and Docker fixes