Windows stops trusting eMudhra certificates on Monday. Replace any emSign certificate this week

We flagged the eMudhra key compromise on October 22. On Wednesday Microsoft said it will start removing the remaining 10 eMudhra root certificates from Windows, Edge and Azure Linux on Monday, November 16.

Any website, VPN portal or internal app that still uses an emSign certificate will start throwing trust errors for Windows users as the change lands.

Windows stops trusting the last eMudhra roots on Monday. If a site or app you run uses an emSign certificate, replace it this week.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Windows drops the last eMudhra roots on Monday

Microsoft’s updated MSRC post says the 10 roots leave the Microsoft Trusted Root Program on November 16. Windows devices pick up the change through automatic root certificate updates. Edge and WebView2 drop emSign Root CA – G1, emSign Root CA – C1, emSign ECC Root CA and emSign Root TLS CA – G1 the same day.

Other vendors are moving too. Chrome will not trust new emSign Root CA – G1 certificates whose first Certificate Transparency timestamp falls after November 16. The Hacker News reports Apple will end trust in all G1 certificates on November 30, and that eMudhra revoked eight more intermediate CAs last week whose keys it cannot show were handled safely.

• eMudhra is leaving the publicly trusted TLS business.
• InCommon, the North American university certificate service that relied on eMudhra, has moved to SSL.com, according to the University of Michigan.

Sites and apps still using emSign certificates

Most companies never bought from eMudhra, but their vendors or partners might have. A supplier portal or SSO endpoint with an emSign certificate breaks for your Windows users on Monday, and the help desk gets the call.

Universities are the largest group affected. The University of Michigan told its IT staff that all InCommon eMudhra certificates must be replaced.

Find and replace emSign certificates before November 16

• Search Certificate Transparency logs (crt.sh or your certificate monitoring tool) for your domains with an issuer containing “emSign” or “eMudhra.”
• Scan internal endpoints for certificates that chain to an emSign root, including load balancers, VPN portals and appliances with their own trust stores.
• Replace any you find with a certificate from another CA before Monday, and test from a fully updated Windows machine.
• Make sure disconnected Windows devices receive the updated trust lists through your update process, as Microsoft advises.
• Don’t re-add trust for the removed roots locally to fix an error. Microsoft warns against it.

Details

• Microsoft: 10 eMudhra roots removed from the Trusted Root Program starting November 16, 2026; Azure Linux images refreshed the same day; Azure CLI 2.93.0 due November 16.
• Chrome: emSign Root CA – G1 certificates with earliest SCT after November 16, 2026, 23:59:59 UTC are not trusted in Chrome 153 and later. emSign ECC Root CA – G3 was removed in October.
• Apple: trust in all G1 certificates ends November 30, per The Hacker News; macOS 27.2.1, 26.7.3 and 15.8.3 already stop bundled command-line tools from accepting the compromised CAs.
• Background: eight intermediate CA keys were generated with weak entropy (October); eight more RSA intermediates were revoked in early November.

Hunt / verify

• Export certificates from your load balancers and reverse proxies and check the issuer chain for emSign.
• Watch help desk tickets after Monday for certificate errors on specific sites, and match them to the issuer.

Source: Microsoft MSRC update, November 11; The Hacker News report

Sources

• Microsoft MSRC: Microsoft’s response to compromised eMudhra certificate authority keys (updated November 11, 2026)
• Google: Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates
• The Hacker News: eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
• University of Michigan Safe Computing: Additional Actions Needed for InCommon Certificates by Nov. 16

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].