微软再次为Windows发布了一个带外更新，但这次并非针对最新故障的紧急修复。这一次，更新完全与证书有关。这个非安全性的带外版本适用于从Windows 11、Windows Server 2025到Windows 10在内的受支持操作系统。它的核心是为那些无法访问微软证书更新服务、或已禁用自动CTL更新的设备更新当前的证书信任列表（CTL）。
Microsoft has released another out-of-band update for Windows, but this one isn't an emergency fix for the latest breakages. This time, it's all about certificates. The non-security out-of-band release applies to supported OSes ranging from Windows 11 and Windows Server 2025, to Windows 10. It's all about updating the current certificate trust list (CTL) of devices that cannot access Microsoft's certificate-update service, or where automatic CTL updates are disabled.
该更新还包含10月13日更新中的全部内容，包括持续存在的VPN问题，以及可能破坏本地Exchange Server的变更。此外，智能应用控制、音频以及非管理员用户的远程桌面连接也可能出现异常，这些都是10月13日更新中的已知问题。这些问题并未在本补丁中解决，因此安装时需留意这一点。同样值得记住的是，许多设备并不需要这个版本，因为当前的证书列表更新通常通过更新服务下发。
It also contains everything in the October 13 update, including the ongoing VPN issues and the change that could break on-premises Exchange Servers. There might also be oddities with Smart App Control, audio, and Remote Desktop connections for non-admin users, all of which are known issues in the October 13 update. These problems are not resolved in this patch, so be aware of this when installing it. It is also worth remembering that many devices will not need this version since the current certificate list updates usually come down through the update service.
然而，如果该服务不可用或未被使用，那么获取这个带外修复可能是个好主意（同时要牢记已知问题），因为在验证应用程序或网站所使用的证书时可能会出现问题。此次带外更新发布之前，微软已就eMudhra证书密钥遭泄露一事说明了其应对措施。这家印度认证机构的私钥本月早些时候遭到泄露，需要进行大规模清理工作。
However, if that service isn't available or being used, it might be a good idea to get this out-of-band fix (while keeping the known issues in mind), since problems can occur when verifying certificates used by applications or websites. The OOB update came after Microsoft laid out its response to the compromised eMudhra certificate keys. The Indian certification authority's private keys were compromised earlier this month, requiring a massive cleanup effort.
据微软称，“它们可能被用来创建证书或签署看似来自受信任CA（证书颁发机构）的内容。”与许多其他组织一样，微软迅速采取行动封堵受影响的证书颁发机构。其做法是更新Windows禁止证书信任列表，以封堵受影响的证书。此外，还为Edge和WebView2单独发布了CRLSet。
According to Microsoft, "they could potentially be used to create certificates or sign content that appeared to come from a trusted CA [certificate authority]." Like many other organizations, Microsoft moved swiftly to block the affected certificate authorities. It did so by updating its Windows Disallowed Certificate Trust List to block the affected certificates. There was also a separate CRLSet release for Edge and WebView2.
据这家Windows巨头称：“10月26日，微软发布了一个带外Windows更新，从Windows信任列表中移除了与受影响层级相关的七个证书：六个eMudhra G3根证书和一个AAA Certificate Services交叉签名。”微软的带外补丁通常是在公司弄坏某个产品、需要发布紧急修复时才会推出。这一次，这一修订是由于“别人的问题”，以及需要向无法接收CTL更新的设备推送CTL更新。®
According to the Windows behemoth, "On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list." Microsoft's out-of-band patches are usually released after the company breaks a product and needs to issue an emergency fix. This time, the revision is due to Somebody Else's Problem and a need to get a CTL update out to devices that are disconnected from CTL updates. ®