Technology
Apple blocks compromised eMudhra certificates but warns some Mac command-line tools remain exposed
Apple says private keys for eight eMudhra intermediate certificate authorities were compromised, allowing six TLS authorities to issue certificates that could impersonate websites. Apple devices already block the affected certificates in Safari, Mail and apps using its networking frameworks. However, macOS and Xcode command-line tools such as git, curl, Python and OpenSSL may continue trusting them through /etc/ssl/cert.pem until a future software update. Administrators can remove relevant root certificates sooner, but the change may affect legitimate sites and require repetition after updates.
Editorial summary · Publisher article
What matters
- Apple began automatically blocking the affected TLS certificates on 19 October and expanded the block on 23 October.
- Most users do not need to edit certificate files because Apple frameworks already enforce the block.
- Administrators using affected command-line tools can apply a documented workaround, with possible compatibility costs.
Context & caveats
- Apple’s guidance says the manual workaround may be replaced by later updates and can disrupt verification for unrelated sites sharing the affected roots.
Why this made the edition
Apple provides detailed, actionable evidence about compromised certificate authorities, the scope of automatic protections and remaining exposure for macOS command-line tools.
Source material