Microsoft update removes seven compromised certificates from Windows trust lists
Microsoft has released a non-security out-of-band Windows update to refresh certificate trust lists on supported devices that cannot reach Microsoft’s certificate-update service or have automatic updates disabled. The change matters because it removes certificates linked to compromised eMudhra keys, reducing the risk that forged certificates could appear to come from a trusted authority.
Released on 26 October, the update removes seven certificates: six eMudhra G3 roots and an AAA Certificate Services cross-sign. Most devices receive trust-list updates automatically and may not need this patch. It also includes the 13 October update, but does not fix its reported VPN, on-premises Exchange, Smart App Control, audio and Remote Desktop issues.
In short
- Microsoft issued an optional Windows certificate update.
- It removes seven certificates linked to affected trust hierarchies.
- Known issues from the 13 October update remain.
Explained simply
Digital certificates help Windows confirm that websites, software and other services are who they claim to be. Windows keeps lists of trusted certificate authorities, organisations whose certificates it accepts as proof of identity.
eMudhra is a certificate authority whose keys were linked to a security compromise. If a compromised certificate remains trusted, it could potentially be used to make a false identity appear legitimate. Microsoft maintains Windows’ trust lists, and most supported devices can receive updates to those lists automatically.
The update is relevant mainly to supported devices that cannot contact Microsoft’s certificate-update service or have automatic updates turned off. It concerns trust in certificates, rather than a fix for the separate problems reported with some Windows features and services.
Business Entertainment Markets Music Software Technology
Read the full article at the source →
Originally published by The Register as “Microsoft releases out-of-band Windows fixes with certificate updates”.