Microsoft Issues Optional Windows Update to Refresh Certificate Trust Lists After eMudhra Key Compromise

Microsoft has released an out-of-band update for supported versions of Windows, including Windows 11, Windows 10 and Windows Server 2025. It is not an emergency fix for recent breakages. It is a non-security update that refreshes the certificate trust list (CTL) on devices that cannot reach Microsoft's certificate-update service, or where automatic CTL updates have been turned off.

The update follows Microsoft's response to the compromise of private keys belonging to eMudhra, an Indian certification authority. Microsoft said the keys could potentially be used to create certificates or sign content that appeared to come from a trusted authority. Microsoft blocked the affected certificates by updating its Windows Disallowed Certificate Trust List, and released a separate CRLSet update for Edge and WebView2. According to Microsoft, the October 26 update removes seven certificates linked to the affected hierarchies from the Windows trust list: six eMudhra G3 roots and an AAA Certificate Services cross-sign.

Many devices will not need this release, because certificate list updates normally arrive through the update service. However, the update also includes everything from the October 13 release, along with its known issues. These include VPN problems, a change that could break on-premises Exchange Servers, and oddities with Smart App Control, audio, and Remote Desktop connections for non-admin users. None of these are fixed here, so test before deploying widely.