Home / Technology / Weak Keys Exposed: Microsoft Revokes eMudhra Certificates
Weak Keys Exposed: Microsoft Revokes eMudhra Certificates
27 Oct
Summary
- Microsoft removed seven eMudhra certificates due to weak private keys.
- Weak keys could allow attackers to forge digital certificates easily.
- Users should ensure automatic updates are enabled for protection.
Microsoft released a critical Windows security update on October 26th, removing seven certificates linked to the Indian company eMudhra. This action was prompted by the discovery that private keys for eight intermediate eMudhra certificates were significantly weak, making them easily replicable.
Such weak keys pose a serious security risk, enabling attackers to forge digital certificates and impersonate legitimate websites or applications. While Microsoft had initially blocked these specific certificates on October 20th, the latest update addresses a wider range by removing certificates higher in the hierarchy.
Microsoft Edge is expected to receive a similar update today, October 27th. For most users, maintaining automatic updates for both their operating system and browsers is the recommended course of action. However, systems that are offline or have automatic updates disabled will need manual intervention to apply these crucial security patches.
