Compromised eMudhra certificates: what to check in your Microsoft 365 environment

What happened

eMudhra, a certificate authority whose roots are trusted by Microsoft, Apple, Google and Mozilla, generated eight intermediate certificates in April 2025 with a faulty script. Their private keys are so weak that they can be recovered from the public certificates in under a second. A researcher proved this on 17 October 2026 by signing a message with each key.

Six of the certificates can issue website (TLS) certificates, which means an attacker could impersonate any site.
Two can issue code-signing certificates.
eMudhra says only one of them reached production, and none issued customer certificates. It's not known whether anyone recovered the keys before the flaw was reported. No attack has been confirmed.

eMudhra has revoked the certificates. Mozilla removed trust in the eMudhra root that signed them, and Google said it will do the same in Chrome.

Who is at risk

Date (2026)	Blocked by
17 October	Firefox and Chrome
20 October	Microsoft (Windows certificate trust list update)
22 October	Apple
Rolling out	Android, through Google Play services updates

Modern browsers were already well protected, because they require every certificate to be published in public logs, and these certificates never issued any. The risk is mainly in:

Devices that haven't received the update, such as an outdated Mac, iPhone or Android phone.
Apps and tools that keep their own list of trusted certificates and don't check those logs: Linux servers, Python, Node.js, Java, curl, and many internal applications. These need software updates from their vendors.

What to check in your Microsoft 365 environment

The fix reaches devices through updates. Five Griffin31 recommendations show whether your devices take updates, and keep out the ones that don't:

Monitor Windows Updates status Windows receives the block through its update channel. This shows which devices are falling behind.
Require minimum Windows OS version a Windows device below the supported version is marked non-compliant and can be kept away from company data.
Require minimum macOS version Macs get the block with system updates, and an outdated Mac is marked non-compliant.
Require the latest iOS version or block access an iPhone or iPad that missed the update loses access until it's updated.
Require the latest Android version or block access an Android device that missed the update loses access until it's updated.

On Windows, also check one setting. Windows downloads its list of blocked certificates on its own, daily, from ctldl.windowsupdate.com, separately from monthly patches. A device can be fully patched and still miss the block if:

a firewall or proxy blocks ctldl.windowsupdate.com (port 80), or
a policy turned off these downloads (registry value EnableDisallowedCertAutoUpdate set to 0 under HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot).

To see when a device last updated the list, run this in an elevated command prompt. The date should be 20 October 2026 or later:

certutil -verifyctl Disallowed | findstr /i "lastsynctime"

Outside Microsoft 365

Servers and developer tools that keep their own certificate list need updating as their vendors advise:

Linux servers: install the updated ca-certificates package from your distribution.
Python, Node.js, Java and Go: update the runtime, and update any certificate bundle the app ships itself (for example, the certifi package in Python).
Azure App Service on Linux: Microsoft has rolled out updated images on the Standard and Latest channels. Built-in PHP 8.2 and end-of-life runtimes are not included, and certificate bundles inside your app or container are not updated by the platform.
Testing: the incident report has commands to check whether a client still trusts the affected certificates. Don't turn off certificate checks to work around errors.

What's next

Microsoft has blocked the certificates on Windows and updated Azure App Service, but has not yet published a security advisory for customers. Once it does, Griffin31 will add a dedicated check that detects whether your environment still trusts the affected certificates, and alert you in the dashboard.

Want to know which of your devices are falling behind on updates? Griffin31 checks your device compliance settings continuously and shows you what to fix first.

Book a demo