Apple has blocked compromised TLS certificates issued by the Indian company eMudhra, but a gap remains on Macs: some command-line tools keep accepting them until the next macOS update. Most users need do nothing, because the block is automatic and requires no installation.
The problem surfaced earlier this month, when a security researcher found that the private keys tied to eight of eMudhra's intermediate certificate authority (CA) certificates were weak. According to Mozilla's incident report cited by BleepingComputer, all eight used P-384 private keys generated in April 2025 with values smaller than 256, so anyone could recover them by testing just 256 numbers. The researcher, known as Wayne, found the weakness on October 17 while scanning publicly available certificate data. With those keys, an attacker could forge certificates for any website, impersonating legitimate sites and intercepting encrypted communications. eMudhra acknowledged the error: its statement said a script error had led to CAs being issued with weak keys, and the affected intermediates were revoked within 14 hours of confirming the issue. According to the company, the intermediates had not issued publicly trusted end-entity certificates and its infrastructure had not been compromised. There is no evidence the keys were exploited.
Image: Apple — https://www.apple.com/it/os/macos/
eMudhra's certificates were trusted by all major browsers, including Safari, Chrome, Edge and Firefox. Apple, according to its support document, has been blocking them since October 19 in Safari, Mail and apps that use Apple's networking and security frameworks. The block happens automatically, with no software update required. On the browser side, Cloudflare said it is deploying mitigations and releasing client updates.
The exception concerns macOS command-line tools such as curl and git, which can still accept the compromised certificates. The risk is concrete for system administrators, who use these tools to connect to servers and services. In the meantime, Apple suggests removing the affected root CA certificates from the /etc/ssl/cert.pem file. A macOS update will include those changes by default, but Apple has not yet given a release date.
Image: Apple — https://help.apple.com/applestyleguide
The episode shows how trust in certificates depends on a chain of authorities: when one link breaks, software vendors must quickly block components that were trusted the day before. For now, professionals using Macs should check which command-line tools rely on those certificates and act manually.
No comments yet. Be the first!