Microsoft pulls 7 eMudhra certificates from Windows. Here’s what that means

Yesterday, October 26th, Microsoft released a Windows security update that removes seven certificates associated with Indian company eMudhra.

The reason for this is that the private keys for eight intermediate certificates held by eMudhra were recently discovered to be so weak that they could be easily recreated, allowing attackers to forge digital certificates and pose as legitimate websites or applications.

Microsoft had previously blocked the affected certificates directly on October 20th, but this new measure goes further by also removing seven certificates higher up in the certificate hierarchy.

A similar change is scheduled for Microsoft Edge today, October 27th. For ordinary Windows users, the recommendation is to allow automatic certificate updates and browser updates to run as normal.

However, computers without an internet connection or with automatic certificate updates disabled may need to be updated manually. For more details and the next steps, this Microsoft blog post.