Apple has started blocking compromised eMudhra certificates in Safari, Mail and apps built on its frameworks. On the Mac, though, several command-line tools such as curl, git and python3 still accept them until a macOS update arrives, and Apple has not said when.
What happened with eMudhra
The private keys of eight intermediate certificate authorities run by India’s eMudhra were compromised. Six issue TLS certificates, the kind that secure websites; two issue code-signing certificates, which Apple’s frameworks do not trust. In principle, anyone holding the keys can create a certificate that looks valid for any website. eMudhra and Sectigo have revoked the affected certificates.
According to MacRumors, a security researcher found the keys were weak, and there is no evidence they were exploited. The Appdook blog, drawing on the researcher’s tracker, goes further: the keys could be guessed in 256 tries, and eMudhra reportedly blames “human errors” during an April 2025 key ceremony. Those details do not come from Apple.
What Apple has already blocked
On October 19, 2026, Apple blocked twelve certificates: six intermediates issued by emSign Root TLS CA – G3 and six cross-signed by Sectigo. On October 23 it also blocked the emSign ECC Root CA – G3 root. Everything is delivered through automatic configuration updates, with no software update needed. Safari, Mail and apps using Apple’s networking and security frameworks are covered, and further blocks will arrive the same way.
The gap in the Mac’s command line
Tools shipped with macOS or the Xcode Command Line Tools that read /etc/ssl/cert.pem, including curl, git, python3, ruby, perl and openssl, skip Apple’s block and revocation checks for certificates chaining to a root in that file. Appdook adds that the built-in pip3 uses its own outdated copy of root certificates. Apps shipping their own root lists are not covered either; Apple tells users to contact the developers.
Apple plans a software update with no date. Its support page does not specify which macOS or iOS versions are affected.
How much risk do you really face?
- On iPhone and iPad, no action is needed.
- On a Mac, if you never use Terminal, Safari and apps going through Apple’s frameworks already reject these certificates.
- If you run scripts or developer tools, some exposure exists, but an attack requires the intruder to be on your network, such as hotel Wi-Fi, and to present a forged certificate for a site your script contacts.
The workaround Apple describes
For administrators, Apple outlines an optional fix: back up /etc/ssl/cert.pem, remove the emSign ECC Root CA – G3 root and, to also block the six Sectigo cross-signed certificates, remove AAA Certificate Services. Then verify the result and restore the backup if something breaks.
Caveats: removing these roots can stop some legitimate sites from verifying, a macOS update may overwrite the file, and administrator rights are required. Once Apple’s update is installed, the workaround is no longer needed.
Key takeaways on the eMudhra certificates
Most of the risk is already gone for everyday users, but developers and Mac administrators stay exposed until macOS is patched. Watch for the next security update and, until then, apply Apple’s workaround if your command-line tools are critical. Do you use curl or git daily on a Mac? Tell us in the comments, and read more of our security alerts on Wanda-techs.com.
Share this content: