🚧

This article is a work in progress.

On Tuesday, 2026-⁠October-⁠20, the general public started learning about the eMudhra compromised SSL/TLS certificates. On 2026-⁠October-⁠21, I tooted this:

Post by @nm@mathstodon.xyz

View on Mastodon

Since I learned about this, I’ve been struggling to update the SSL/TLS certificates on Windows. Now that I figured out what the issues were on my Windows devices, I’m posting some tips here.

1. Make sure your Windows updates are not paused. Mine were because I almost always pause them for as long as possible. This was not a good idea during this eMudhra situation.😱
2. Update Windows.
3. In Microsoft’s Edge web browser, do the things I wrote in my toot above, i.e., go to both of these web pages to see if your SSL/TLS certificate stack is accepting the compromised eMudhra certs:
   • emudhra.we-have-a-problem.com
   • bgp.tools
4. If it appears that Edge is using bad certs and you did Steps #1 and #2, it might be that Edge is caching an old test result. To test without the cache, open an Edge “New InPrivate window” and repeat Step #3 in the private window.

For me, the above 4 steps worked. I hope they work for you too!

important

A lot of tools, including some web browsers, use their own certificate stack so it’s possible – probably likely – that other tools on your device are vulnerable. To test your other web browsers (Brave, Chrome, Firefox, qutebrowser, etc.), go to these two web pages in each browser on your device:

• emudhra.we-have-a-problem.com
• bgp.tools

If a browser (or any tool) is using the old certs, update that tool ASAP.

Mastodon toots tagged #emudhra

Thanks to idotj's Mastodon embed timeline widget for making it possible to embed these toots.

Endnotes