Apple has released macOS updates that close a security gap involving compromised certificates from Indian digital certification company eMudhra, extending protections to affected command-line tools such as curl and git after earlier measures protected Safari, Mail, and apps using Apple's networking and security frameworks.
The updates, released today, prevent affected command-line tools from accepting the compromised certificates, eliminating the need for administrators to manually address the issue, Apple said. The company began automatically blocking the affected certificates in October in Safari, Mail, and apps using Apple's networking and security frameworks after Mozilla reported that private keys of eight intermediate certificate authorities operated by eMudhra had been compromised.
In response to the compromise, Apple began automatically blocking the affected certificates on October 19, with additional protections on October 23. Those changes were delivered through automatic certificate configuration updates, but did not cover certain command-line tools, including curl and git, which could still accept the compromised certificates.
Apple published a support article at the time with instructions for administrators to manually address the remaining security gap. Today, Apple updated that document to confirm the fix is now available.
The updates - macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3 - also remove five root CA certificates from /etc/ssl/cert.pem, including three additional eMudhra certificates that were not part of Apple's original manual workaround.
For users unable to install the latest updates, Apple continues to provide manual workaround instructions, including the names and SHA-256 fingerprints of the 12 affected certificates and five root CA certificates removed. Apple noted that "some apps and tools include their own list of root CA certificates and don't use Apple's block or /etc/ssl/cert.pem," and advised users to contact the developer of those apps and tools.
Analysis
Why This Matters
- The compromised certificates could have allowed attackers to impersonate websites and intercept sensitive data, making this a serious security supply-chain issue.
- The gap in command-line tool coverage meant that developers and system administrators using tools like curl and git remained exposed even after Apple's initial blocking.
- The updates also remove additional eMudhra root certificates, suggesting a broader reassessment of trust in eMudhra's certification authorities.
Background
eMudhra is an Indian digital certification company whose intermediate certificate authorities' private keys were compromised, as reported by Mozilla. Certificate authorities issue digital certificates that verify website identities and enable secure HTTPS connections. When private keys of intermediate CAs are compromised, attackers can create fraudulent certificates that appear legitimate. Apple's response has been to block the affected certificates in stages, with today's update closing the final known gap.
Key Perspectives
Apple: Released macOS updates to block compromised eMudhra certificates in command-line tools, removing the need for manual workarounds, and advises users with apps that manage their own root CA lists to contact developers.
Mozilla: Reported that private keys of eight intermediate certificate authorities operated by eMudhra had been compromised, triggering Apple's block.
What to Watch
- Whether eMudhra revokes the compromised certificates and what steps it takes to prevent future compromises.
- Whether other platforms and browsers update their trust stores to similarly block the affected certificates.
- If any misuse of the compromised certificates is detected in the wild.
Checked
11 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedApple’s macOS updates close a security gap involving compromised eMudhra certificates.9to5Mac: “Today’s macOS updates fix security gap involving eMudhra certificates. Apple today released macOS updates that address a security gap involving compromised eMudhra certificates”
- SupportedThe updates cover affected command-line tools missed by earlier protections, and administrators who install them do not need to address the issue manually.9to5Mac: “macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3, released earlier today, prevent the affected command-line tools from accepting the compromised certificates, eliminating the need for administrators to manually address the issue.”
- SupportedApple says some apps and tools use their own root CA lists rather than Apple’s block or /etc/ssl/cert.pem, and advises users to contact their developers.9to5Mac: “Apple also notes that “some apps and tools include their own list of root CA certificates and don’t use Apple’s block or /etc/ssl/cert.pem,” and advises users to contact the developer of those apps and tools.”
- SupportedThe updates prevent affected command-line tools, including curl and git, from accepting the compromised certificates.9to5Mac: “certain command-line tools, including curl and git, could still accept the compromised certificates.”
- SupportedMozilla reported that private keys of eight intermediate certificate authorities operated by eMudhra had been compromised.9to5Mac: “Mozilla reported that private keys of eight intermediate certificate authorities operated by eMudhra, an Indian digital certification company, had been compromised.”
- SupportedApple began automatically blocking the affected certificates on October 19 and added protections on October 23.9to5Mac: “Apple began automatically blocking the affected certificates on October 19, followed by additional protections on October 23.”
- SupportedThe earlier measures protected Safari, Mail and apps using Apple’s networking and security frameworks, but did not cover certain command-line tools.9to5Mac: “these measures protected Safari, Mail, and apps that use Apple’s networking and security frameworks, they didn’t cover all of macOS, as certain command-line tools, including curl and git, could still accept the compromised certificates.”
- SupportedApple had published a support article with manual instructions for administrators, then updated it to confirm the fix was available.9to5Mac: “At the time, Apple published a support article with instructions for administrators to manually address this remaining security gap, while promising a fix in a future macOS update. Today, Apple updated the document to confirm that the fix is now available.”
- SupportedThe updates are macOS 27.2.1, macOS 26.7.3 and macOS 15.8.3.9to5Mac: “macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3, released earlier today”
- SupportedThe updates remove five root CA certificates from /etc/ssl/cert.pem, including three additional eMudhra certificates not in Apple’s original manual workaround.9to5Mac: “The updates also remove five root CA certificates from /etc/ssl/cert.pem, including three additional eMudhra certificates that weren’t part of Apple’s original manual workaround.”
- SupportedFor users unable to install the updates, Apple’s manual instructions include names and SHA-256 fingerprints of 12 affected certificates and five root CA certificates removed by the updates.9to5Mac: “Apple continues to provide instructions for manually addressing the issue in its support document, along with the names and SHA-256 fingerprints of the 12 affected certificates and five root CA certificates removed by the updates.”
