Apple today released macOS updates that address a security gap involving compromised eMudhra certificates, after initially blocking them in Safari, Mail, and other apps in October. Here are the details.
A bit of context
A few weeks ago, Mozilla reportedthat private keys of eight intermediate certificate authorities operated by eMudhra, an Indian digital certification company, had been compromised.
In essence, these certificates are used to establish trust in digital certificates that verify website identities and enable secure connections.
With access to the compromised private keys, bad actors could potentially create fraudulent certificates that appear legitimate, allowing them to impersonate websites and intercept sensitive user information.
In response to the compromise, Apple began automatically blocking the affected certificates on October 19, followed by additional protections on October 23.
These changes were delivered through automatic certificate configuration updates, meaning users didn’t need to install a macOS update to be protected.
While these measures protected Safari, Mail, and apps that use Apple’s networking and security frameworks, they didn’t cover all of macOS, as certain command-line tools, including curl and git, could still accept the compromised certificates.
At the time, Apple published a support article with instructions for administrators to manually address this remaining security gap, while promising a fix in a future macOS update.
Today, Apple updated the document to confirm that the fix is now available.
Apple closes remaining eMudhra security gap
As Apple explains, macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3, released earlier today, prevent the affected command-line tools from accepting the compromised certificates, eliminating the need for administrators to manually address the issue.
The updates also remove five root CA certificates from /etc/ssl/cert.pem, including three additional eMudhra certificates that weren’t part of Apple’s original manual workaround.
Still, for users who are unable to install the latest macOS updates, Apple continues to provide instructions for manually addressing the issue in its support document, along with the names and SHA-256 fingerprints of the 12 affected certificates and five root CA certificates removed by the updates.
Apple also notes that “some apps and tools include their own list of root CA certificates and don’t use Apple’s block or /etc/ssl/cert.pem,” and advises users to contact the developer of those apps and tools.
To read Apple’s full support document, follow this link.
Worth checking out on Amazon
- Apple HomeView
- Apple TV 4K (2026) | Siri Remote (2026)
- Apple Watch Series 12 | Ultra 4
- AirPods Pro 3 | AirPods 5
- AirTag (2nd Generation) – 4 Pack
- MacBook Neo
- Logitech MX Master 4
You’re reading 9to5Mac — experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel
