Why would an update interrupt access?
Why would a security update make a legitimate website stop working? Your browser relies on certificates—digital credentials that help establish a website’s identity. A certificate authority (CA) issues those credentials. If the browser stops trusting an authority behind a website’s certificate, access can be interrupted even when the website itself remains legitimate.
Microsoft’s October 2026 eMudhra changes illustrate this tradeoff. Microsoft reported eight recoverable intermediate CA private keys: secret signing keys belonging to authorities within eMudhra’s certificate hierarchy. Someone with those keys could create apparently legitimate certificates or sign malicious software as though it came from a trusted publisher.
Revocation and root removal are different
Revocation withdraws a certificate’s validity. eMudhra revoked the affected intermediate certificates, while Microsoft separately blocked the affected authorities. An intermediate authority sits within a certificate chain: a sequence connecting a certificate to a trusted root, the authority accepted as the chain’s foundation.
Removing a root from a trust list is a broader decision about which foundations the software accepts. Microsoft released a Windows update on October 26 removing seven certificates associated with the affected hierarchies, then removed the same seven from Edge’s trust list on October 27. That decision extends beyond blocking the identified compromised intermediate keys.
A legitimate service can lose its trusted chain
In this hypothetical example, you visit a booking website whose certificate depends on a removed root. After the trust update reaches your device, that chain is no longer trusted by default. The interruption does not, by itself, establish that the booking website was compromised; its certificate dependency needs attention.
Consider replacement before restoring trust
For service administrators, consider identifying dependent certificates and arranging replacements or an alternative trusted chain. Restoring trust locally deserves care: Microsoft warns that software which does not reliably check revocation or its blocked-certificate list could still accept certificates associated with the compromised intermediates. The useful takeaway is to address the certificate dependency before restoring the trust that made the connection possible.