Today’s macOS updates fix security gap involving eMudhra certificates

Apple has released macOS updates to resolve a security vulnerability linked to compromised eMudhra certificates, which were initially blocked in Safari, Mail, and other applications in October. Initial concerns arose after Mozilla disclosed that the private keys of eight intermediate certificate authorities managed by eMudhra, an Indian digital certification firm, had been breached.

These certificates serve to establish trust in digital certificates that authenticate websites and facilitate secure connections. With access to the compromised keys, malicious actors could potentially create fraudulent certificates that appear authentic, enabling them to mimic websites and intercept sensitive data.

In response to this compromise, Apple promptly blocked the affected certificates on October 19 and implemented additional safeguards on October 23, all through automatic certificate configuration updates. This meant users were automatically protected without needing to install a macOS update. However, these measures did not cover all macOS functionalities, as certain command-line tools such as curl and git could still accept the compromised certificates.

Apple provided instructions via a support article for administrators to manually rectify this lingering security issue, promising a solution in an upcoming macOS update. Today, Apple confirmed that the fix is now integrated into macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3, released recently. These updates ensure that the affected command-line tools no longer accept the compromised certificates, eliminating the necessity for manual intervention.

In addition to removing five root CA certificates from /etc/ssl/cert.pem, the updates also exclude three extra eMudhra certificates not included in the initial manual workaround.

Nevertheless, for users unable to install the most recent macOS updates, Apple continues to offer instructions for manually addressing the issue in its support document. This document includes the names and SHA-256 fingerprints of the 12 affected certificates and the five root CA certificates removed through the updates. Apple emphasizes that some applications and tools contain their own list of root CA certificates and do not rely on Apple’s block or /etc/ssl/cert.pem. They advise users to reach out to the developers of such applications and tools.

For Apple’s comprehensive support document, please visit this link. To stay updated with the latest Apple news, visit 9to5Mac on YouTube.