Last updated: November 4, 2026, 6:30 AM IST
If you use a Windows PC in India — for office work, for filing taxes, for signing documents online, for running a business — there is an update you should not ignore. On October 26, 2026, Microsoft released emergency, out-of-band Windows updates that remove seven certificates linked to eMudhra, one of India's licensed certifying authorities, from the Windows trust list. Google, Mozilla and Apple have also blocked the affected certificates.
The reason is as serious as certificate problems get. Eight intermediate certificate authority (CA) private keys belonging to eMudhra were found to be recoverable — meaning, in plain terms, that the secret keys used to vouch for the identity of websites and services could potentially be reconstructed by someone who should not have them. When a CA's private keys are compromised, the whole point of the system breaks: a browser can no longer be sure that the "secure" site it is talking to is really who it claims to be.
Microsoft's fix is blunt and deliberate: stop trusting those certificates entirely. The updates are KB5134133 for Windows 11 and KB5134125 for Windows 10. They arrived outside the normal monthly Patch Tuesday cycle, which is Microsoft's way of signalling urgency — out-of-band updates are reserved for problems that cannot wait for the next scheduled round.
What Are Certificates, and Why Does This Matter?
Every time you see the padlock in your browser, a chain of trust is working behind the scenes. Your browser trusts a small set of root certificate authorities. Those roots vouch for intermediate authorities, which vouch for individual websites. If any link in that chain is compromised, an attacker could, in theory, create a fake certificate for a real site and intercept traffic that users believe is secure.
That is why the discovery about eMudhra's intermediate keys set off alarms across the industry, not just at Microsoft. Certificate authorities are the plumbing of internet trust — invisible when they work, catastrophic when they fail. The coordinated response from Microsoft, Google, Mozilla and Apple is the system working as designed: when one authority's keys are suspect, every major platform stops trusting them, quickly, and at the same time.
eMudhra is a significant Indian certifying authority, licensed under India's IT Act framework, and its certificates are used across Indian government services, banking, digital signatures and enterprise systems. That is why this story has a sharper edge in India than a typical browser-security item: the affected certificates touch the infrastructure Indian users rely on for official and financial transactions.
What Microsoft's Update Does
The out-of-band updates remove the seven affected eMudhra-linked certificates from the Windows trusted certificate store. After the update, Windows will no longer accept those certificates as proof of identity. Any website, service or application still relying on one of the blocked certificates will show a certificate error — the browser warning page that tells you the connection is not private — instead of loading normally.
That breakage is intentional. It is better for a site to fail loudly with a warning than to load silently under a certificate that can no longer be trusted. But it does mean that some Indian websites and services that have not yet migrated to new certificates may stop working for updated Windows users until their operators fix the problem on their side.
Microsoft published the details through its Security Response Center (MSRC) advisory, and coverage from The Register, CyberPress and Brandefense on October 26–28 confirmed the scope: seven certificates removed, eight intermediate CA private keys found recoverable, and coordinated blocking across the major browser and platform vendors.
What Indian Users Must Do
First, install the update. On Windows 11, that means KB5134133; on Windows 10, KB5134125. For most users, Windows Update will deliver it automatically, but if you have updates paused or deferred — a common habit on office machines — check manually: Settings, then Windows Update, then Check for updates. Do not skip this one because it arrived outside Patch Tuesday. That is precisely why it matters.
Second, if a site you rely on starts showing a certificate error after the update, do not click through the warning. The warning is the protection working. Contact the site's operator or your organisation's IT team and tell them the site may be using a blocked eMudhra certificate. Legitimate operators will need to reissue their certificates through a trusted authority; that is their fix to make, not yours to bypass.
Third, if you manage devices that are offline or rarely updated — a factory machine, a branch-office PC, a relative's old laptop — those devices are the ones at risk. An unpatched machine will keep trusting the blocked certificates, which means it remains exposed to exactly the impersonation risk the update removes. Offline devices need the update applied manually, and that step is easy to forget until something goes wrong.
Fourth, update your browsers too. Chrome, Firefox, Edge and Safari have their own certificate stores and their own blocking actions, and keeping them current is part of the same defence. A patched Windows with an ancient browser is still a gap.
What About Digital Signatures?
This is the question Indian businesses and professionals are asking most urgently, and the answer is nuanced. eMudhra is also a major provider of digital signature certificates (DSCs) used for income-tax filing, GST, MCA filings and tendering. The blocked certificates are the intermediate CA certificates in the trust chain — not necessarily every individual DSC — but any service whose chain depends on a blocked intermediate will be affected until it is reissued.
If you use a DSC for filings, the practical advice is: test it before your deadline, not on it. Try the signing workflow on an updated machine well ahead of any filing date. If it fails with a certificate error, contact your DSC provider — eMudhra or your reseller — for reissuance guidance. Do not wait until the last day of a filing window to discover a chain problem.
For organisations, the same logic applies at scale. IT teams should audit which internal and vendor services depend on eMudhra certificates, prioritise the ones facing customers or handling filings, and confirm with vendors that reissuance is complete. The coordinated, multi-vendor nature of this block means there is no workaround based on switching browsers — the certificates are distrusted everywhere that matters.
How Did the Keys Become Recoverable?
The technical detail reported alongside the block is that eight eMudhra intermediate CA private keys were found to be recoverable — a finding that, in certificate-security terms, is about as bad as it gets short of confirmed active misuse. Recoverable keys mean the private material could be reconstructed from available information, rather than being safely confined to the hardware security modules where CA keys are supposed to live.
There is no public evidence, in the reporting to date, that the keys were actively exploited before the block. But the industry does not wait for proof of exploitation in cases like this. The entire trust model depends on CA keys being unrecoverable by anyone except the authority itself; once that assumption fails, distrust is the only safe response, and speed matters more than certainty about misuse.
It is also worth noting what this incident is not. It is not a Windows vulnerability, not a virus, and not something that affects only Indian users' machines. It is a trust infrastructure decision, applied globally, that happens to hit Indian services hardest because eMudhra's footprint is largest in India. Users outside India will mostly never notice it.
The Bigger Lesson
Certificate authorities are one of those systems that work so quietly that most people never learn they exist — until the day they fail. This incident is a useful reminder that internet security rests on a surprisingly small number of trusted institutions, and that the system defends itself not through any single company's action but through coordinated distrust: Microsoft, Google, Mozilla and Apple all moving within days of each other.
For Indian users and businesses, the lesson is more concrete: keep updates automatic, test critical signing workflows early, and treat a certificate warning as information, not an obstacle to click past. The padlock in your browser is only as trustworthy as the chain behind it — and this week, that chain got a necessary repair.
Frequently Asked Questions
What is the eMudhra Windows update?
Microsoft's out-of-band update of October 26, 2026 — KB5134133 for Windows 11 and KB5134125 for Windows 10 — removes seven eMudhra-linked certificates from the Windows trust list after eight intermediate CA private keys were found recoverable.
Do I need to install it manually?
Usually not — Windows Update delivers it automatically. But if you have updates paused or deferred, check manually under Settings, then Windows Update. Offline or rarely updated machines need the update applied by hand.
Why do some sites show certificate errors after the update?
Because those sites still rely on a blocked eMudhra certificate. The error is the protection working. Do not click through it; the site's operator needs to reissue its certificate through a trusted authority.
Does this affect my digital signature certificate (DSC)?
Possibly, if the service you sign with depends on a blocked intermediate certificate. Test your signing workflow on an updated machine well before any filing deadline, and contact your DSC provider for reissuance if it fails.
Have Google, Mozilla and Apple done the same?
Yes. All major browser and platform vendors have also blocked the affected certificates, so switching browsers will not bypass the block.
Sources
- The Register — Microsoft Releases Out-of-Band Windows Fixes With Certificate Updates
- CyberPress — Microsoft Windows Updates: eMudhra CA Keys
- Brandefense — eMudhra CA Key Compromise Security News
My Personal Take
Here is what I actually think about this story: it is the rare security incident where the system worked. A bad key situation was found, four giant companies moved within days, and the fix is a Windows Update you can install in two minutes. That is not a scary story. That is the immune system doing its job.
The people who will get hurt are the ones who treat the certificate warning as an annoyance to click past, or who discover the problem on the last day of a filing deadline. So my advice is boring and specific: install KB5134133 or KB5134125 today, test your DSC this week, and never, ever click through a certificate warning on a site that handles your money or your identity. Boring advice is what keeps you safe.
0 Comments