New Delhi: Microsoft has removed seven certificates linked to Bengaluru-based cybersecurity firm eMudhra Ltd from the list of certificates trusted by Windows and its Edge browser, the latest step by global technology companies after the security mechanism associated with eight of the firm’s intermediate certificates was found to be compromised.
In a post on its Security Response Center blog on 26 October, Microsoft said it had pushed out-of-band updates for Windows 10 and Windows 11, KB5134125 and KB5134133. These remove six eMudhra “G3” root certificates and one certificate cross-signed by Sectigo, a US certificate authority, under its AAA Certificate Services root.
The updates target computers that do not receive Microsoft’s automatic certificate updates. Microsoft removed the same seven certificates from Edge on 27 October. Chrome’s removal of eMudhra’s emSign ECC Root CA – G3, announced by Google last week, was also scheduled for that day.
“Microsoft is evaluating the remaining eMudhra roots separately and will sequence any further changes as affected customers transition away from those hierarchies,” the company said. Google has said it is reviewing eMudhra’s other root in its store, emSign Root CA – G1. Mozilla has said it is not removing G1 at this time.
A root sits at the top of a chain of trust, and devices accept every certificate issued under it. Removing the G3 roots, Microsoft said, goes beyond the step it took on 20 October, when it blocked the eight compromised intermediate certificates. The removal protects software that does not check lists of revoked certificates.
The keys behind six of the eight could have been used to “impersonate a website or service and potentially intercept users’ communications”, and the other two to “make malicious software appear to come from a trusted publisher”, it said, advising organisations not to restore trust in the removed roots “without understanding the associated risk”.
Software makers have followed suit. On 27 October, Eclipse Temurin, a widely used distribution of Java, removed emSign ECC Root CA – G3 and Sectigo’s AAA Certificate Services root from the list of certificates its releases trust, while keeping G1.
The weak private keys were reported by a researcher to Apple, Google, Microsoft, Mozilla and eMudhra on 17 October. Mozilla said they were numbers below 256, and could be recovered almost instantly.
eMudhra, which issues the Digital Signature Certificates Indians use to file tax returns and company forms, has attributed them to a script error at a key generation ceremony on 30 April, 2025. “The flaw was ours,” the company said in a statement. On 22 October, it announced it would exit the global website certificate business, which it says is about one percent of its revenue. Almost all of the 30,800 certificates under the G3 root had been issued to US universities through InCommon, which moved to eMudhra this year.
In India, exposure rests on the G1 decision. A scan of the `.bank.in` domain by the consumer platform CashlessConsumer found at least seven banks—including Bandhan Bank, Bank of India and Jammu and Kashmir Bank—using eMudhra certificates that chain to roots still trusted by browsers.
eMudhra’s shares fell to a 52-week low of Rs 318 on the Bombay Stock Exchange on 26 October. That is about 53 percent below their 16 September-high of Rs 677.50, with a 43 percent fall in five sessions. On 23 October, the ratings agency ICRA retained its A (Stable) rating on the company’s credit limits. It flagged reputational damage, regulatory uncertainty and the risk of losing banking and government customers abroad.
The Ministry of Electronics and Information Technology has formed a team to investigate. It has said that eMudhra’s domestic digital signature and eSign services, regulated by the Controller of Certifying Authorities, are unaffected. The ministry has not published findings, and the controller has not made a public statement.