Skip to content
Griffin31 Help Center

Compromised eMudhra certificates: what to check in your Microsoft 365 environment

Published 23 October 2026

What happened

Section titled “What happened”

eMudhra, a certificate authority whose roots are trusted by Microsoft, Apple, Google and Mozilla, generated eight intermediate certificates in April 2025 with a faulty script. Their private keys are so weak that they can be recovered from the public certificates in under a second. A researcher proved this on 17 October 2026 by signing a message with each key.

  • Six of the certificates can issue website (TLS) certificates, which means an attacker could impersonate any site.
  • Two can issue code-signing certificates.
  • eMudhra says only one of them reached production, and none issued customer certificates. It’s not known whether anyone recovered the keys before the flaw was reported. No attack has been confirmed.

eMudhra has revoked the certificates. Mozilla removed trust in the eMudhra root that signed them, and Google said it will do the same in Chrome.

Who is at risk

Section titled “Who is at risk”
Date (2026) Blocked by
17 October Firefox and Chrome
20 October Microsoft (Windows certificate trust list update)
22 October Apple
Rolling out Android, through Google Play services updates

Modern browsers were already well protected, because they require every certificate to be published in public logs, and these certificates never issued any. The risk is mainly in:

  • Devices that haven’t received the update, such as an outdated Mac, iPhone or Android phone.
  • Apps and tools that keep their own list of trusted certificates and don’t check those logs: Linux servers, Python, Node.js, Java, curl, and many internal applications. These need software updates from their vendors.

What to check in your Microsoft 365 environment

Section titled “What to check in your Microsoft 365 environment”

The fix reaches devices through updates. Five Griffin31 recommendations show whether your devices take updates, and keep out the ones that don’t:

  1. Monitor Windows Updates status: Windows receives the block through its update channel. This shows which devices are falling behind.
  2. Require minimum Windows OS version: a Windows device below the supported version is marked non-compliant and can be kept away from company data.
  3. Require minimum macOS version: Macs get the block with system updates, and an outdated Mac is marked non-compliant.
  4. Require the latest iOS version or block access: an iPhone or iPad that missed the update loses access until it’s updated.
  5. Require the latest Android version or block access: an Android device that missed the update loses access until it’s updated.

On Windows, also check one setting. Windows downloads its list of blocked certificates on its own, daily, from ctldl.windowsupdate.com, separately from monthly patches. A device can be fully patched and still miss the block if:

  • a firewall or proxy blocks ctldl.windowsupdate.com (port 80), or
  • a policy turned off these downloads (registry value EnableDisallowedCertAutoUpdate set to 0 under HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot).

To see when a device last updated the list, run this in an elevated command prompt. The date should be 20 October 2026 or later:

Terminal window
certutil -verifyctl Disallowed | findstr /i "lastsynctime"

Outside Microsoft 365

Section titled “Outside Microsoft 365”

Servers and developer tools that keep their own certificate list need updating as their vendors advise:

  • Linux servers: install the updated ca-certificates package from your distribution.
  • Python, Node.js, Java and Go: update the runtime, and update any certificate bundle the app ships itself (for example, the certifi package in Python).
  • Azure App Service on Linux: Microsoft has rolled out updated images on the Standard and Latest channels. Built-in PHP 8.2 and end-of-life runtimes are not included, and certificate bundles inside your app or container are not updated by the platform.
  • Testing: the incident report has commands to check whether a client still trusts the affected certificates. Don’t turn off certificate checks to work around errors.

What’s next

Section titled “What’s next”

Microsoft has blocked the certificates on Windows and updated Azure App Service, but has not yet published a security advisory for customers. Once it does, Griffin31 will add a dedicated check that detects whether your environment still trusts the affected certificates, and alert you in the dashboard.

Free assessment

Section titled “Free assessment”

Sources

Section titled “Sources”

Cookie settings · Privacy policy