Microsoft to Remove 10 More eMudhra Certificates From Windows 11 and Edge on November 16

Microsoft will remove 10 remaining eMudhra root certificates from Windows, Microsoft Edge, and WebView2 on November 16, 2026, as part of its ongoing effort to address security concerns involving the Indian certificate authority.

According to Microsoft 365 Message Center notification MC1529467, the changes will roll out automatically through existing certificate update mechanisms, without requiring users to install a new Windows cumulative update or browser version.

Microsoft continues removing eMudhra certificates from Windows

Microsoft previously released emergency updates KB5134133 and KB5134134 on October 28, 2026, removing seven eMudhra certificates from the Windows trusted certificate list.

The company followed up on October 29 by removing trust for the same certificates in Microsoft Edge.

The November 16 update will remove the remaining 10 eMudhra root certificates, completing Microsoft’s planned removal of default trust for the affected certificate authority.

Once the changes take effect, Windows and Microsoft’s browsers will no longer automatically trust certificates that depend on the removed roots.

Windows, Edge, and WebView2 will receive automatic certificate updates

Microsoft will distribute the Windows certificate changes through its Automatic Root Certificates Update mechanism, which retrieves updated Certificate Trust Lists (CTLs) from Microsoft’s servers.

Windows devices will download the updated trust information through the ctldl.windowsupdate.com endpoint without requiring a separate cumulative update.

Microsoft Edge and WebView2 will receive the changes through their PKI Metadata component, which checks for updates every 10 hours and shortly after application launches.

This approach allows Microsoft to update certificate trust independently of regular Windows and browser releases.

IT administrators may need to update certificates manually

Most Windows users won’t need to take any action, provided their devices can access Microsoft’s certificate update services.

However, organizations operating disconnected systems or internet-restricted networks may need to distribute the updated Certificate Trust Lists manually.

Administrators can configure Group Policy to redirect certificate updates to internal servers and use certutil -syncWithWU to synchronize certificate trust files.

Microsoft recommends keeping automatic root certificate updates enabled to ensure devices stop trusting certificates that no longer meet its security requirements.

Organizations that rely on certificates issued through the affected eMudhra roots should also review their certificate dependencies before November 16 to avoid potential trust-related issues.

In other news, Microsoft has ended security updates for Exchange Server 2016 and 2019, leaving both versions permanently vulnerable. The company also acknowledged KB5132061 installation failures and is rolling out an automatic fix for affected devices.

Via Neowin